Unified Logging

The single logging system of macOS since 10.12 Sierra, where the kernel, Apple daemons and os_log clients write their messages.

Unified Logging is the logging system Apple introduced with macOS 10.12 Sierra (and iOS 10). The kernel, Apple's daemons and any code calling os_log send entries to logd, which stores them in binary tracev3 files under /private/var/db/diagnostics. Message text is kept apart, in uuidtext and dsc files, and time is converted with timesync records.

For investigators it is the richest timeline on a Mac. See the forensics guide.