MacOS – Where is system.log in TimeMachine backup

logsmacostime-machine

I would like to get older versions of /private/var/log/system.log files from TimeMachine. Is this possible? How?

I see current system.log files. I went to folder /private/var/log then invoked TimeMachine.

enter image description here

When I go back to previous backup, I do not see system.log files.

enter image description here

relates to
can-i-find-out-the-last-time-a-specific-usb-was-connected-to-my-mbp7

User want to look through macOS log files to see history of external drive mounting. Data is in "/private/var/log/system.log". Needed data is a month old. A month is longer than normal backup of system.log is keep. Attempted to look in timemachine backup but it seems the older system.log files are not kept.

Best Answer

Everything in /private is excluded by rule - including /var/log/system.log

tmutil isexcluded /private/var/log/*

More details on this are at On OS X, what files are excluded by rule from a Time Machine backup?

You would need another tool to back these up as I’ve not had luck using the tmutil removeexclusion /var/log/system.log command which might have worked if the exclusion was based on a file pattern and not the rule.

Related Question