0

The log show command output from a macOS High Sierra is detailed below:

**Command 1**
 log show --info --predicate 'eventMessage contains "system boot:"'

log: warning: ./system_logs.logarchive present but reading from system log store.
    Filtering the log data using "eventMessage CONTAINS "system boot:""
    Skipping debug messages, pass --debug to include.
    Timestamp                       Thread     Type        Activity             PID    TTL  
    2019-03-23 21:48:12.000000+0530 0x0        Timesync    0x0                  0      0    === system boot: F2089765-6B22-4EEA-B0A2-898726E1F57E
    2019-03-25 09:58:05.000000+0530 0x0        Timesync    0x0                  0      0    === system boot: 039103F9-8353-4344-A97E-38BB08EE8FFC
    2019-03-25 20:55:31.000000+0530 0x0        Timesync    0x0                  0      0    === system boot: A71B7566-88BB-4271-8437-454357766C51
    2019-03-26 09:58:04.000000+0530 0x0        Timesync    0x0                  0      0    === system boot: 29D9BC4A-E16D-4722-89C4-3D28155AEE73

I filtered the log show command output using the following:

**Command 2**
log show --info --predicate 'eventMessage contains "system boot:"'|awk 'BEGIN { OFS="\t"; print "Date(YYYY-MM-DD)","Time(IST)", "Type","\t Boot Message" } {print $1,$2,$4,$9,$10,$11}'|sed '2d'

Output:

log: warning: ./system_logs.logarchive present but reading from system log store.

Date(YYYY-MM-DD)    Time(IST)        Type        Boot Message
2019-03-23  21:48:12.000000+0530    Timesync    system  boot:   F2089765-6B22-4EEA-B0A2-898726E1F57E
2019-03-25  09:58:05.000000+0530    Timesync    system  boot:   039103F9-8353-4344-A97E-38BB08EE8FFC
2019-03-25  20:55:31.000000+0530    Timesync    system  boot:   A71B7566-88BB-4271-8437-454357766C51
2019-03-26  09:58:04.000000+0530    Timesync    system  boot:   29D9BC4A-E16D-4722-89C4-3D28155AEE73
2019-03-27  10:11:33.000000+0530    Timesync    system  boot:   A2D4C446-597D-468D-BD89-BD36008969CB
2019-03-27  20:48:38.000000+0530    Timesync    system  boot:   B4F5495F-DE8E-4669-8544-FE413479475D
2019-03-28  13:07:41.000000+0530    Timesync    system  boot:   8B745BF2-FE44-46F5-A0D1-B473CA105874
2019-03-29  09:57:59.000000+0530    Timesync    system  boot:   0496C812-683F-4AE0-ACA4-2450C9B5608C
2019-03-30  12:37:12.000000+0530    Timesync    system  boot:   8A999D8A-B4B2-4E1B-AA40-106D115C2E38
2019-04-01  10:09:12.000000+0530    Timesync    system  boot:   DD16C0BB-D717-4218-AF89-F31FC6D657E1

What are the best options (awk|sed|cut|xargs etc.):

  • For producing column names underlined or in any format best suited for the readers eyes.

  • Refer Command 2 output-columns-$9,$10,$11.How do we reduce the space between $9,$10 & $11.?

  • Using sed '1d' does not delete the first line output -"log: warning: ./system_logs.logarchive present but reading from system log store." either from Command 1 nor from Command 2.How can this be addressed?

  • The log show command takes a bit of time (2-5 minutes) to parse the Unified logs.How can such progress be displayed to the user in percentage format.

Thanks in advance.

  • 1
    I can help with a couple points: sed '1d' isn't removing that line because it's printed to stderr, you can hide it by redirecting stderr to null i.e. 2>/dev/null. Additionally, for formatting the headers, you can have awk print color codes: stackoverflow.com/a/6540890/4307665 – Egon Apr 22 at 16:43
  • Your $9,$10,$11 columns in Command 2 are spaced like that since you changed the awk default OFS (output field separator) from space to tab. You can use awk's printf instead of print to better control formatting. – GracefulRestart Apr 22 at 19:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.