FileVault 2 and system log file

Discussion in 'OS X Yosemite (10.10)' started by joe4444, Feb 19, 2015.

  1. joe4444 macrumors newbie

    Feb 14, 2015
    I noticed something odd today. In my system log file, which is on my FileVault 2 encrypted volume of course, I see a line similar to this:

    hfs mounted macintosh hd on device root_device
    There are also some lines about CoreStorage unlocking the volume.

    If the volume is locked and encrypted, then how can these lines be written to a log file on said encrypted volume? Are they actually stored in memory temporarily, and once the volume is mounted and unlocked, THEN it retroactively logs these items?
  2. mfram macrumors 65816

    Jan 23, 2010
    San Diego, CA USA
    Probably a message from the kernel. The kernel has its own internal log buffer. The logging daemon knows about the kernel log. Once the logging daemon starts, it will read what's in the kernel log buffer and write it to the log file.
  3. joe4444 thread starter macrumors newbie

    Feb 14, 2015
    Do you know where I can find kernel.log in Yosemite? I'm not seeing it in /var/logs/ or in the Console for some reason. Does it go by a different name? Or do I need to look on the boot partition?

Share This Page