The Unified Log: Reading macOS Like a Forensic Analyst - Predicates, Subsystems, Signposts, and sysdiagnose in Depth #1007983

Every event on a Mac leaves a trace in the unified log. A keychain query, a TCC denial, a launch failure, a TLS handshake, a screen recording start — all of it lands in a structured store that most users never see and most developers never learn to query. This book teaches you to read it.

It walks the os_log and OSLog APIs that produce entries, the predicate grammar that filters them, the five persistence levels and what each one actually keeps on disk, and the privacy annotations that redact sensitive data by default. From there it moves into signposts and Instruments for performance work, the .tracev3 binary format and its uuidtext string tables, sysdiagnose collection and archive anatomy, and the forensic workflows that reconstruct user activity from log data across authentication, keychain, network, and process events.

Real commands throughout: log show, log stream, log collect, log config, sysdiagnose, plus jq, sqlite3, and shell scripting patterns for automation. Written for macOS developers, systems administrators, incident responders, and anyone who has ever typed log show and gotten back a wall of text they could not make sense of.