Tips

Some random insights.

Download history

Almost eveyr donwloaded files is recorded by LSQuarantineEvent, a SQLite3 database.

/Users/<User>/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2

Logs location

Since MacOS Sierra (2016), Apple moved from standard unix log text files to unified logs. These are compressed, privacy-enabled logs and available accross the ecosystem (macOS, iOS, watchOS, tvOS).

The files uses a propritary format and they lives in :

• /var/db/diagnostics/Persist/

• /var/db/diagnostics/Special/

• /var/db/uuidtext/

Some common text log files are still available here :

• ~Library/Logs

• /Library/Logs - system applications, diags

• /var/log - system logs

• /var/logs - some apps are logging there

Logs can also be viewed with Finder > Applications > Utilities > Console or the command line log show -style syslog --info --last XXX.

The cli also allows to export them with log collect.

Log collect can also be used to get logs from an external device such as an iPhone or iPad.

1. Connect the iPhone and iPad. Devices must trust each others.

2. log collect --device <device_name> --output <output_archive>