logs in macbook pro

[cindyjj]

Is there a list of all the things that occur on one's macbook pro (late 2011). For example, the date and time a photo was taken with photobooth. I know that would be recorded with the photo for overt viewing, but is the event recorded in the computer somewhere as log? Or if a recording was being made in photobooth and for some reason it shut itself off before the recording was completed, would the event of the commencement of the recording be recorded in the logs of the computer?

 

[leman]

OS X keeps an extensive collection of logs. Most of them are located in Library/Logs as well as /var/log. I do not believe that Photo Booth logs its actions though.

 

[hiddenmarkov]

Apple's syslog like most, they cover generic stuff. Looking for more application stuff it might be best to look for logs they might have local to them. Usually this in their application folder area or their application support folder you can see when you go to the hidden library folder. To see this library hover over finder--go and press alt and it shows up (if you are not familiar with how, if you are may be of use to another reader who isn't). Or look at applications documentation/support site to find this (if present) faster.

Best you might get in normal syslog is abnormal terminations due to an error that tripped something in system.

 

[cindyjj]

"Best you might get in normal syslog is abnormal terminations due to an error that tripped something in system."
Could you explain this a bit more, please.

 

[leman]

"Best you might get in normal syslog is abnormal terminations due to an error that tripped something in system."
Could you explain this a bit more, please.

It means that if some application has crashed, you might find a more detailed explanation of the crash (including the crash report and diagnostic messages) in the system log.

 

[hiddenmarkov]

"Best you might get in normal syslog is abnormal terminations due to an error that tripped something in system."
Could you explain this a bit more, please.

Off top of head and more windows based (logs I see most), if an application is creating issues for the system you might see the core logs mention the application causing the issue (if only by process or executable name) and give it a generic event ID that means its not a more full blown M$ event ID (these get better details since M$ wrote them).


Its an event that says there is a problem, it seems to be this application and it does not give details. This usually due to vendors have a log structure much different from an OS'. Windows logs, *nix logs and even say Cisco have a kind of template. it works for them. It also helps in analysis/monitoring as you have set ways things are. When I parse logs (or applications do it for me) they are cleaned up and data I actually want is pulled out quick and easy.


Application logs though....I have seen several applications have markedly different formats.

When my Symantec endpoint clients act up at work for example all windows logs says is SEP is causing/having some kind of issue. I have to look at symantec logs for the client to get more details. Windows not being lazy....symantec logs can be very detailed and no way is it fitting in the windows template.