Skip to content
Unified LogParser

Series

Unified Log fundamentals

3 posts in this series. Read them in order or jump to any one.

  1. macOS Unified Logs Forensics: A Practical Guide

    What macOS Unified Logs record, where tracev3, uuidtext and timesync live, what they can and cannot prove, and a workflow to read them for an investigation.

  2. The tracev3 File Format Explained

    Inside macOS tracev3 files: header, catalog and LZ4 chunksets, firehose, oversize, statedump and simpledump chunks, uuidtext and dsc strings, and timesync.

  3. log show NDJSON Exports and Unified Log Timelines

    Export macOS Unified Logs with log show (ndjson, json, text styles), avoid time-zone traps, compare parsers and build CSV or Timesketch timelines.

All posts in this series

macOS Unified Logs Forensics: A Practical Guide
What macOS Unified Logs record, where tracev3, uuidtext and timesync live, what they can and cannot prove, and a workflow to read them for an investigation.
macosunified-logsdfirtimeline
The tracev3 File Format Explained
Inside macOS tracev3 files: header, catalog and LZ4 chunksets, firehose, oversize, statedump and simpledump chunks, uuidtext and dsc strings, and timesync.
macosunified-logsfile-formatdfir
log show NDJSON Exports and Unified Log Timelines
Export macOS Unified Logs with log show (ndjson, json, text styles), avoid time-zone traps, compare parsers and build CSV or Timesketch timelines.
macosunified-logstimelinetools