Persisted log entries disappeared?

Question

Created 1d

Replies 1

Boosts 0

Participants 2

Hi!

I was able to successfully persist my debug log entires using the OSLogPreferences key in my Info.plist and retrieve the logs from my iPhone using log collect.

This worked to get log messages created when my app executed a background task tonight (2026-01-20 00:20). But log Debug and Default log messages from a normal run yesterday (2026-01-19 15:34) disappeared.

I can query for the missing messages in the log archive I created yesterday but they are missing in the log archive I created today covering also yesterday. I had invoked:

% sudo log collect --device-name "<my device name>" --last 25h --output /tmp/system_logs.logarchive

...

%sudo log show /tmp/system_logs.logarchive --debug --info --predicate 'subsystem=="com.example.MyApp"'

Is this expected and/or is there anything I could do to persist the logs for a longer period?

For reference, that's what I have added to my Info.plist for the debug build configuration so far:

    <key>OSLogPreferences</key>
    <dict>
        <key>com.example.MyApp</key>
        <dict>
            <key>DEFAULT-OPTIONS</key>
            <dict>
                <key>Level</key>
                <dict>
                    <key>Enable</key>
                    <string>Debug</string>
                    <key>Persist</key>
                    <string>Debug</string>
                </dict>
                <key>Enable-Private-Data</key>
                <true/>
            </dict>
        </dict>
    </dict>

Answered by DTS Engineer in 873208022

Each system log entry has time to live (TTL) value. You can see evidence for this in various places within the UI. For example:

% sudo log stream
… TTL  
… 0    fseventsd: (libsystem_info.dylib) Resolve user group list
…
… 7    WindowServer: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp …

AFAIK there’s no supported way to override that, but if you poke around in /System/Library/Preferences/Logging on your Mac it’s not hard to see how it works.

WARNING As with all implementation details, there’s no guarantee that this will actually work, or that it hasn’t worked differently in the past, or will work differently in the future. So don’t build knowledge of this into a product that you ship to a wide range of users.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

1h

Recommended

Each system log entry has time to live (TTL) value. You can see evidence for this in various places within the UI. For example:

% sudo log stream
… TTL  
… 0    fseventsd: (libsystem_info.dylib) Resolve user group list
…
… 7    WindowServer: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp …

AFAIK there’s no supported way to override that, but if you poke around in /System/Library/Preferences/Logging on your Mac it’s not hard to see how it works.

WARNING As with all implementation details, there’s no guarantee that this will actually work, or that it hasn’t worked differently in the past, or will work differently in the future. So don’t build knowledge of this into a product that you ship to a wide range of users.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0