Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

joe4444

macrumors newbie
Original poster
Feb 14, 2015
11
0
I noticed something odd today. In my system log file, which is on my FileVault 2 encrypted volume of course, I see a line similar to this:

Code:
hfs mounted macintosh hd on device root_device

There are also some lines about CoreStorage unlocking the volume.

If the volume is locked and encrypted, then how can these lines be written to a log file on said encrypted volume? Are they actually stored in memory temporarily, and once the volume is mounted and unlocked, THEN it retroactively logs these items?
 

mfram

Contributor
Jan 23, 2010
1,304
341
San Diego, CA USA
Probably a message from the kernel. The kernel has its own internal log buffer. The logging daemon knows about the kernel log. Once the logging daemon starts, it will read what's in the kernel log buffer and write it to the log file.
 

joe4444

macrumors newbie
Original poster
Feb 14, 2015
11
0
Probably a message from the kernel. The kernel has its own internal log buffer. The logging daemon knows about the kernel log. Once the logging daemon starts, it will read what's in the kernel log buffer and write it to the log file.

Do you know where I can find kernel.log in Yosemite? I'm not seeing it in /var/logs/ or in the Console for some reason. Does it go by a different name? Or do I need to look on the boot partition?
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.