MacOS – System logs backup with Time Machine

By default the contents of the /private/var/log directory is excluded from Time Machine backups. This can be changed to include the contents however because this is a system file it is probably more prudent to backup the excluded files you would like to have backed up by copying the files to a location that is included in Time Machine backups. That said however, I disagree with cppl's statement "Given that changing core files is always a bad idea" because when done properly and with the knowledge and understanding of what one is doing it's just not an issue!

If you really want to include /private/var/log directory in your Time Machine backups then here is what you can do. To make this easier and more safe I'd recommend using this tested script. It first backs up the bundle and plist and only removes /private/var/log if it in its default location within the .plist file. Note: This script must be run using sudo or as root.

In a Terminal:

touch modtm
open modtm

In the opened modtm document:

Copy and paste the code shown below into the document and save it, then close it.

Back in the the Terminal, make the script executable:

chmod u+x modtm

Now with the script ready to execute, in the Terminal:

sudo ./modtm

Enter your password, which will not show as you type it, and then press Enter.

If defaults were in play then /private/var/log should have been safely removed, by virtue of first backing up, from the StdExclusions.plist file.

Code:

#!/bin/bash

set -ex

    # Make sure script was run using 'sudo' or by 'root'.

if [[ $(id -u) != 0 ]]; then
   echo "This script must be run as root." 1>&2
   exit 1
 else
        # Set variables.

    b="/System/Library/CoreServices/backupd.bundle"
    f="/System/Library/CoreServices/backupd.bundle/Contents/Resources/StdExclusions.plist"
    e="/private/var/log"

        # Backup, by copy, both the bundle and plist.

    [[ ! -d ${b%%.*}.ORI.${b##*.} ]] && cp -aR "$b" "${b%%.*}.ORI.${b##*.}"
    [[ ! -f $f.ORI ]] && cp -a "$f" "$f.ORI"

        # Get the value of the first element of the 'FileContentsExcluded' array.

    v="$(/usr/libexec/PlistBuddy -c "Print :FileContentsExcluded:0" "$f")"

    if [[ $v == $e ]]; then
            # Target value matched, delete it from .plist file.
        /usr/libexec/PlistBuddy -c "Delete :FileContentsExcluded:0"  "$f"
        echo "$e removed from $f"
    else
        echo "$e not found where expected!"
        exit 1
    fi
    exit 0
fi

Image showing syntactical highlighting:

Note: This script cannot be run in OS X 10.11 unless SIP is temporarily disabled.