Unified Logs
macOS Unified Logging system (tracev3) containing system, application, and security events.
- Status
- available
- CLI plugin
- system.unifiedlogs
- Categories
- system
Overview
The Unified Logging system (introduced in macOS 10.12) provides a centralised, efficient logging mechanism for the entire operating system. These logs contain invaluable forensic data including authentication events, application activity, and system state changes.
macfor wraps Apple's log tool. It produces a hashed copy of the raw store (/var/db/diagnostics and /var/db/uuidtext), a .logarchive from log collect, and six predicate-filtered NDJSON extracts from log show. Live collection requires root.
Analysis Tips
- Authentication tracking: Look for loginwindow and authorization subsystems
- Process execution: Track process launches and terminations
- Network activity: Monitor connection establishment and failures
- Security events: Review security subsystem for policy violations
- Timestamp precision: Unified logs provide nanosecond-precision timestamps
Extracted Event Sets
macfor runs log show with six predicate presets and writes each to its own NDJSON file:
| Preset | Covers |
|---|---|
auth | loginwindow, opendirectoryd, authorization and securityd, plus sudo and sshd |
usb | USB device attach and detach (IOUSBFamily, usbmuxd) |
network | Network connections, DNS (mDNSResponder) and network extensions |
exec | Process execution, code signing (AMFI), kernel and launchd events |
xprotect | XProtect, syspolicy and quarantine verdicts |
tcc | TCC privacy-consent events |
The full .logarchive is collected too, so you can run any other predicate offline.
Related Artifacts
- FSEvents - Correlate file activity with log events
- Shell History - Match commands to process logs
References
Data sources
/var/db/diagnostics/
System and application log entries
/var/db/diagnostics/
Timestamp synchronization data
/var/db/
Format-string store used to render log messages