From time to time, I have a look at the syslog using the log command in the terminal. It is relatively clear that old logs are deleted after a while, but today I stumbled across an issue that makes me think that older logs are "less complete" than newer ones.
Normally, searching for things like the "closed" flag or "screenlockflag" in the logs allows for a precise reconstruction of when the MacBook was opened/closed or the screen was locked. For log entries that date back around a week, I find inconsistencies like the screenlockflag being set to 1 without having been set to 0 any time before or having the lid closed without the screenlockflag being set to 1.
So it seems that some entries that should normally be there are simply gone. Is that normal?
EDIT: I don't know if this is important, but I did run the log command with the predicate 'process == loginwindow"'. If I remove this, I get log entries that date back further, so it almost seems as if the login window log entries a removed earlier than others.
Normally, searching for things like the "closed" flag or "screenlockflag" in the logs allows for a precise reconstruction of when the MacBook was opened/closed or the screen was locked. For log entries that date back around a week, I find inconsistencies like the screenlockflag being set to 1 without having been set to 0 any time before or having the lid closed without the screenlockflag being set to 1.
So it seems that some entries that should normally be there are simply gone. Is that normal?
EDIT: I don't know if this is important, but I did run the log command with the predicate 'process == loginwindow"'. If I remove this, I get log entries that date back further, so it almost seems as if the login window log entries a removed earlier than others.