1

I would like to get older versions of /private/var/log/system.log files from TimeMachine. Is this possible? How?

I see current system.log files. I went to folder /private/var/log then invoked TimeMachine.

enter image description here

When I go back to previous backup, I do not see system.log files.

enter image description here

relates to can-i-find-out-the-last-time-a-specific-usb-was-connected-to-my-mbp7

User want to look through macOS log files to see history of external drive mounting. Data is in "/private/var/log/system.log". Needed data is a month old. A month is longer than normal backup of system.log is keep. Attempted to look in timemachine backup but it seems the older system.log files are not kept.

historystamp
  • 1,900
  • System log files are excluded from TM backups (see this question and the file /System/Library/CoreServices/backupd.bundle/Contents/Resources/StdExclusions.plist). AIUI this is because log files change all the time, and the method TM uses to make incremental backups would not work well with log files. – Gordon Davisson Aug 18 '19 at 21:20
  • TimeMachine is intended as a safetynet for users, as such, it doesn’t track temporal system data. This is common accross many backup and versioning solutions – John Keates Aug 19 '19 at 08:27

1 Answers1

3

Everything in /private is excluded by rule - including /var/log/system.log

tmutil isexcluded /private/var/log/*

More details on this are at On OS X, what files are excluded by rule from a Time Machine backup?

You would need another tool to back these up as I’ve not had luck using the tmutil removeexclusion /var/log/system.log command which might have worked if the exclusion was based on a file pattern and not the rule.

bmike
  • 235,889