I have an M2 Pro with Ventura 13.6.6. I am trying to get some information about a recent power outage. Is there a way to see the exact times that the AC adapter was connected / disconnected? Is there some messages hiding in some system log somewhere that I can look for or perhaps some battery history system utility? I know very little about macOS so I'm not sure what to look for or where.

I am racking my head for an [old login password] (pass1) that is gone from my keychain but still in a Time Machine backup. The password I seek [encrypts an external drive] (pass2), which used to unlock automagically by virtue of being in the keychain so I did not memorise it. However losing (pass2) now would also mean losing a good deal of data. I still know some of the passwords in that keychain (pass3), but I have forgotten the master password (pass1). Unfortunately I have been using complex passwords for some time now and will not be able to brute force it with the likes of hashcat easily. Nevertheless, I hope to recover the old login password (pass1) by deducing what the hash and salt of the keychain is from the other known passwords (pass3). Does macOS store remnants or clear version of passwords in any locations? edit: I was quite lousy with my password and found some old passwords in Copyclip, an app that logs text copied to clipboard (security risk, yes); I also have Near Lock which I think might log some keystrokes but I am still investigating, and am wondering if there might be other somewhat common places that might have passwords stored due to poor security practices.

I have a MacBook Pro (Computer A) which freezes / restarts during startup. To investigate the problem, I purchased a brand new internal disk and did a basic installation (10.13 - the latest this model supports) on a working MacBook Pro (Computer B). This clean install boots on at least 4 Macs I have at my disposal. But, on Computer A, it will startup, the progress bar will advance to about 60% and then it will restart and do the same thing. Or it will freeze the second time. When I booted in Verbose mode, the last lines I got were: DSMOS has arrived Unsupported CPU Unsupported CPU Unsupported PCH AppleHDAEngineOutput::performFormatChange (, , 0) en2: promiscuous mode enable succeeded IOConsoleUsers: time(0) 0->0, lll 0, llk1, IOConsoleUsers: gIOScreenLockState 3, hs 0, bs 0, now 0, sm 0x0 at which point it hung. I booted Computer B in verbose mode and was able to look at the logs and follow those error messages, but there are many additional lines there that aren't displayed on the screen during verbose mode startup. If I boot Computer A in Target Disk mode, I can mount its disk on Computer B, so I don't believe the SATA cable is the problem. Ultimately, I'd like to determine what the root of the problem is, but an interim step is to compare the log files from the disks in Computers A and B. Is it possible to look at the log file from Computer A while accessing its disk as an external disk on Computer B? (If you have an idea why it might be restarting/hanging, I'd welcome help on that, too.)

I am using macOS Catalina (10.15) and I spent about an hour exporting some photos from Photos to my friend's SD card, which seems to involve a lot of computing (it's not the same as copying files). That's OK. It was plugged in to power the whole time, so I was at 100% battery. When I finished, I closed all the applications except Chrome browser with a single empty tab and closed the lid. This normally puts my laptop into to sleep mode. I unplugged it and slid it into the protective case in my backpack as I've been doing every day for several years now. Three hours later, I pulled it out on the bus to do some work and the fan was running, it was hot, and the battery was at 8%. I took the screenshot below and then shut the computer down so I could safely put it back in its protector. **Question:** How can I find out what my MacBook Air was doing for 2 hours in my backpack (hot and at 8% battery) when I thought it was sleeping? Are there log files I can check for a few hour period to see what was using so much power? There is a *very remote* possibility that I had used sudo pmset -a disablesleep 1 recently to listen to some music with the lid closed on another bus ride, but I doubt it. Nevertheless I need to rule this out. Is there a way I can check the status of disablesleep during that time period, or find logs of the instances when it changed status? [](https://i.sstatic.net/JgTKq.jpg) *** **Update 1:** I'm not seeing any way to get an hourly summary unless it's this stuff from Activity Monitor (below) which goes for only 12 hours in my very old Catalina OS. (I will be updating, as soon as I can convince the App store to recognize my Apple ID, perhaps that will solve several lingering problems). [](https://i.sstatic.net/or0qa.png) **Update 2:** In response to the suggested queries in @Ruskes's [answer](https://apple.stackexchange.com/a/469237/143729) here are the results. Note that I put my laptop in my backpack somewhere around 10:45 to 11:45, and then opened it back up around 14:15, noticed the problem and shut it down. I later plugged it in to charge and restarted around 16:00 The command log show --style syslog --last 36h | grep "Wake reason" yielded 2024-02-13 06:24:18.304815+0800 localhost powerd: [powerd:sleepWake] Wake reason: "" identity: "" 2024-02-13 06:24:39.508966+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: TDM0 XHC1 2024-02-13 06:24:39.508967+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: TDM0 XHC1 2024-02-13 06:46:17.830890+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _isWakeReasonVoiceTrigger] Wake reason: 2024-02-13 06:46:17.830895+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _getPowerAssertionIfWakenByVoiceTriggerNotFromS3Sleep] Wake reason is not VoiceTrigger or it woke from S3 2024-02-13 06:46:18.991668+0800 localhost powerd: [powerd:sleepWake] Wake reason: "" identity: "" 2024-02-13 06:46:20.152147+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 06:47:07.548976+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.USBC (Maintenance) 2024-02-13 06:47:07.548979+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.USBC (Maintenance) 2024-02-13 06:48:04.648201+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _isWakeReasonVoiceTrigger] Wake reason: 2024-02-13 06:48:04.648208+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _getPowerAssertionIfWakenByVoiceTriggerNotFromS3Sleep] Wake reason is not VoiceTrigger or it woke from S3 2024-02-13 06:48:04.656591+0800 localhost powerd: [powerd:sleepWake] Wake reason: "" identity: "" 2024-02-13 06:48:05.642408+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 06:48:05.718097+0800 localhost powerd: [powerd:sleepWake] Wake reason: "" identity: "" 2024-02-13 06:48:05.720483+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 06:49:22.965033+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 10:43:53.090984+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.USBC (User) 2024-02-13 10:43:53.091000+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.USBC (User) 2024-02-13 14:18:40.937986+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _isWakeReasonVoiceTrigger] Wake reason: 2024-02-13 14:18:40.938058+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _getPowerAssertionIfWakenByVoiceTriggerNotFromS3Sleep] Wake reason is not VoiceTrigger or it woke from S3 2024-02-13 14:18:53.279118+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 15:59:42.233613+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 16:05:38.933380+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.RTC (Alarm) 2024-02-13 16:05:38.933382+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.RTC (Alarm) 2024-02-13 16:15:29.675109+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _isWakeReasonVoiceTrigger] Wake reason: 2024-02-13 16:15:29.675120+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _getPowerAssertionIfWakenByVoiceTriggerNotFromS3Sleep] Wake reason is not VoiceTrigger or it woke from S3 2024-02-13 16:15:31.685736+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 16:16:19.364015+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.RTC (Alarm) 2024-02-13 16:16:19.364017+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.RTC (Alarm) 2024-02-13 16:30:30.669710+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _isWakeReasonVoiceTrigger] Wake reason: [...] The command log show --style syslog | fgrep "Wake reason" yielded [...] 2024-02-13 06:24:18.304815+0800 localhost powerd: [powerd:sleepWake] Wake reason: "" identity: "" 2024-02-13 06:24:39.508966+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: TDM0 XHC1 2024-02-13 06:24:39.508967+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: TDM0 XHC1 2024-02-13 06:46:17.830890+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _isWakeReasonVoiceTrigger] Wake reason: 2024-02-13 06:46:17.830895+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _getPowerAssertionIfWakenByVoiceTriggerNotFromS3Sleep] Wake reason is not VoiceTrigger or it woke from S3 2024-02-13 06:46:18.991668+0800 localhost powerd: [powerd:sleepWake] Wake reason: "" identity: "" 2024-02-13 06:46:20.152147+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 06:47:07.548976+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.USBC (Maintenance) 2024-02-13 06:47:07.548979+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.USBC (Maintenance) 2024-02-13 06:48:04.648201+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _isWakeReasonVoiceTrigger] Wake reason: 2024-02-13 06:48:04.648208+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _getPowerAssertionIfWakenByVoiceTriggerNotFromS3Sleep] Wake reason is not VoiceTrigger or it woke from S3 2024-02-13 06:48:04.656591+0800 localhost powerd: [powerd:sleepWake] Wake reason: "" identity: "" 2024-02-13 06:48:05.642408+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 06:48:05.718097+0800 localhost powerd: [powerd:sleepWake] Wake reason: "" identity: "" 2024-02-13 06:48:05.720483+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 06:49:22.965033+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 10:43:53.090984+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.USBC (User) 2024-02-13 10:43:53.091000+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.USBC (User) 2024-02-13 14:18:40.937986+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _isWakeReasonVoiceTrigger] Wake reason: 2024-02-13 14:18:40.938058+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _getPowerAssertionIfWakenByVoiceTriggerNotFromS3Sleep] Wake reason is not VoiceTrigger or it woke from S3 2024-02-13 14:18:53.279118+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 15:59:42.233613+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 16:05:38.933380+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.RTC (Alarm) 2024-02-13 16:05:38.933382+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.RTC (Alarm) 2024-02-13 16:15:29.675109+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _isWakeReasonVoiceTrigger] Wake reason: 2024-02-13 16:15:29.675120+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _getPowerAssertionIfWakenByVoiceTriggerNotFromS3Sleep] Wake reason is not VoiceTrigger or it woke from S3 2024-02-13 16:15:31.685736+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 16:16:19.364015+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.RTC (Alarm) 2024-02-13 16:16:19.364017+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.RTC (Alarm) 2024-02-13 16:30:30.669710+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _isWakeReasonVoiceTrigger] Wake reason: 2024-02-13 16:30:30.669719+0800 localhost corespeechd: [com.apple.corespeech:Framework] -[CSHostDaemonMac _getPowerAssertionIfWakenByVoiceTriggerNotFromS3Sleep] Wake reason is not VoiceTrigger or it woke from S3 2024-02-13 16:30:31.804000+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 16:30:31.859119+0800 localhost kernel: (AppleTopCaseHIDEventDriver) [HID] [ATC] AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Host (0x01) 2024-02-13 16:31:20.329319+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.RTC (Alarm) 2024-02-13 16:31:20.329321+0800 localhost kernel: (AppleACPIPlatform) AppleACPIPlatformPower Wake reason: EC.RTC (Alarm) [...] The command log show --style syslog | fgrep "DarkWake" is too long, dense, and verbose to include.

I swap in multiple Time Machine backup drives on my main desktop to have redundant backups. At least I try to. However, lately backups to one of my disks seems to always fail, possibly because Time Machine only tries to backup to the other. However, I'm not sure as the only error I get from the main UI is "Backup Failed". No indication of whether any files were backed up, which files weren't backed up, or why. Is there any way I can get more detailed failure information from Time Machine so I can see what's going wrong so I can fix it?

I would like to enable logging on my file sharing service. (It's crashing intermittently and I can't figure out why.) When I inspect the plist for the file sharing service **smbd** on my Mac running Mojave, I see: user@mac:~ $ plutil -p /Library/Preferences/SystemConfiguration/com.apple.smb.server.plist { "AclsEnabled" => 1 "DOSCodePage" => "437" "LocalKerberosRealm" => "LKDC:SHA1..." "LogLevel" => 0 "NetBIOSName" => "transom" "ServerDescription" => "Transom" "SigningRequired" => 0 } So, it looks like logging is configured with the parameter "LogLevel". I've read the smbd man page, and it's not much help, with this parameter. - What are the allowed log levels? - Which level is best for debugging **smbd** crashes? - What's the preferred method for tweaking a value? (plutil can set, or...)

I have /private/var/db/uuidtext/dsc directory full of files. Directory size is >100GB and constantly growing. I've deleted all the files and also tried to reboot my mac, but it doesn't help. I've found little info about this directory, but it looks like that these files are log files, but I'm not able to figure out which process causes such a logging. Is there any way to figure out what causes this heavy logging?

I have set up a custom .plist in ~/Library/LaunchAgents to run a process (offlineimap ) on a periodic basis. I've specified both the StandardOutPath and StandardErrorPath keys to point to files in my home directory, which works. However, this doesn't really provide a complete logging solution from what I can see. The logs are not rotated, there are no timestamps (addressed by this question , although there was no clear answer), and the log is not integrated into any other logging on the system. I think I would prefer it if the logs went to Unified Logging . I'm used to systemd logging on Linux, which is a similar mechanism, and it would be great if there was a similar way I could redirect that output into the system-wide log, viewable with the log command. Is there any way to do that with a custom LaunchAgent? I should add that I'm using MacOS 10.14.5.

iOS currently has a limit of 100 phone calls that can be stored in the call log. Is there a similar limit for SMS or MMS messages? If so, what it is? Where is this documented?

The /var/log/com.apple.xpc.launchd/launchd.log file on a Mac computer (Mac Mini M1) is getting lots of the following lines (about 4160 per minute, which is 66 per second):

2024-10-21 16:28:09.167884 (gui/2001 ) : denied lookup: name = com.apple.audio.audiohald, flags = 0x9, requestor = Google Chrome H, error = 159: Sandbox restriction
2024-10-21 16:28:09.167952 (gui/2001 ) : denied lookup: name = com.apple.audio.audiohald, flags = 0x9, requestor = Slack Helper (G, error = 159: Sandbox restriction

I do have the same error lines on some other Mac computers, but not as much/fast (2 per second). I suspect it's "eating" some of my IO and slowing down the computer (as well as using the SSD). What does it means? How can I fix/disable/ignore them? If it's coming from a misconfiguration of macOS: Is there a way/command to fix it? Version: * macOS is version 14.2.1 (build 23C71). * Slack is version 4.40.133 ([the latest available as of 2024-10-21](https://slack.com/intl/fr-fr/release-notes/mac)) * Chrome is version 130.0.6723.59 (the latest available as of 2024-10-21)

Looking at iOS 11 logs using Console.app in High Sierra, I see that many important bits of information are masked like this: nsurlsessiond Triggering periodic update to powerlog for client dasd Trigger: is now [] Yelp Reservations Map Extension [19 ] start which makes it hard to see what's really happening. This happens on macOS too, and it can be changed with this command sudo log config --mode 'private_data:on', as described here . How can I enable logging private data on iOS?

I am looking for a replacement for good old logger which is adapted to the new macOS logging. It should which read from stdin. Especially I want to set a kind of tag to more easily filter output later on in _Console.app_ resp. log.

I looked on the Mac Console app's system.log to determine the cause of network disconnection events, and saw these "ASL Sender Statistics". A Reddit post (https://www.reddit.com/r/MacOS/comments/1ds4c9z/asl_sender_statistics) suggests it's just a generic message, and @bmike clarified to me the number (in this case 360) is just the process ID of the syslog daemon itself. Given various posts about this including on Apple's Forum etc, can someone definitively say there is no info to be garnered from these log messages, or if there is, where can one find it?

What is the best way of logging the pairing / commissioning process of Matter and HomeKit Accessories (Console logs are encrypted / lacking). I could not find any specific software or documentation provided by Apple regarding this (nor any other participant of the CSA).

In the root folder of the sysdiagnose logs analytic data there is a specific file named "microstackshots". Have someone tried to investigate its content? I could not find a way to execute/read it. If I extract it the result is a microstackshot.out file which seems to be executable on Apple OS. Here a description of what it is about. Thank you so much for your help!

I need to share the syslog over udp to a remote server. I have configured syslog.conf to share the logs with *.* @remote_server:ip, but not all logs are getting transferred to the server, logs on user authentication failure seems to be missing. I used log stream to write the logs to /var/log/test.log file. This file is however not being picked up by the syslog daemon for forwarding. Is there an option by which I can avoid the usage of remote_syslog2 and any other third party application. Can I just configure asl.conf to replace the use of log stream command

Is there a way to see the filenames of files I recently pressed cmd-backspace on in Finder? I was deleting some folders in Application Support belonging to apps I uninstalled long ago. I was just using Finder to delete them. Then I emptied trash. Now I realize it would have been more useful to copy the old apps' names first, to scan my entire disk for any remnant files they left behind that I can now clean out too. But I've forgotten what the names of what some of the old apps were, was too quick to empty trash too. Is there a way to check what the names of those folders were?

I am trying to get sysdiagnose data on iPhone. After many tries and waiting, nothing is appearing inside **Analytics & Improvements** -> **Analytics Data**. I have followed these [guides](https://developer.apple.com/bug-reporting/profiles-and-logs/?name=sysdiagnose) : 1. Sysdiagnose (iOS) - When I hold UP and DOWN volume buttons + POWER button for 1-1.5 sec, I get vibration but nothing else happen, no logs 2. iOS Sysdiagnose (Using AssistiveTouch) - When I click on Analytics button in AssistiveTouch, I am getting message: "AssistiveTouch Failed to gather analytics. Please try again." After few resets situation is the same. I am using: - iPhone 12 Max Pro - iOS 16.7.1 Did somebody have this issue and found a solution?