Unified Log Parser — Blog https://www.unifiedlogparser.com/en/blog Latest from Blog en Wed, 30 Sep 2026 00:50:47 GMT Open a .logarchive in Your Browser, on Any OS https://www.unifiedlogparser.com/en/blog/analyze-logarchive-in-browser https://www.unifiedlogparser.com/en/blog/analyze-logarchive-in-browser Step by step: open a macOS .logarchive, diagnostics folder or log show export in the free Unified Log Parser, triage findings, set a time range and export. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT How to Collect macOS Unified Logs for Forensics https://www.unifiedlogparser.com/en/blog/collect-macos-unified-logs https://www.unifiedlogparser.com/en/blog/collect-macos-unified-logs Collect macOS Unified Logs with log collect, a raw copy of diagnostics and uuidtext, UAC, Velociraptor or mac_apt, and avoid the gaps that break parsing. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT log show NDJSON Exports and Unified Log Timelines https://www.unifiedlogparser.com/en/blog/log-show-ndjson-export-timeline https://www.unifiedlogparser.com/en/blog/log-show-ndjson-export-timeline Export macOS Unified Logs with log show (ndjson, json, text styles), avoid time-zone traps, compare parsers and build CSV or Timesketch timelines. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT macOS Unified Log Triage: Queries That Matter https://www.unifiedlogparser.com/en/blog/macos-unified-log-triage-queries https://www.unifiedlogparser.com/en/blog/macos-unified-log-triage-queries log show predicates and parser filters for sudo, SSH, Screen Sharing, TCC, Gatekeeper, XProtect, launch agents, login items, USB mounts and the log command. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT macOS Unified Logs Forensics: A Practical Guide https://www.unifiedlogparser.com/en/blog/macos-unified-logs-forensics-guide https://www.unifiedlogparser.com/en/blog/macos-unified-logs-forensics-guide What macOS Unified Logs record, where tracev3, uuidtext and timesync live, what they can and cannot prove, and a workflow to read them for an investigation. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT The tracev3 File Format Explained https://www.unifiedlogparser.com/en/blog/tracev3-file-format-explained https://www.unifiedlogparser.com/en/blog/tracev3-file-format-explained Inside macOS tracev3 files: header, catalog and LZ4 chunksets, firehose, oversize, statedump and simpledump chunks, uuidtext and dsc strings, and timesync. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT