While the man page explicitly states that log collect --predicate accepts NSPredicate as well as shorthand, in practice it does not.
# Shorthand. log crashes, sudo crashes
$ sudo log collect --predicate 's:^"com.apple.power"'
log: Unable to process predicate: Unable to parse the format string "s:^"com.apple.power""
Trace/BPT trap: 5
# Full predicate. OK
$ sudo log collect --predicate 'subsystem BEGINSWITH "com.apple.power"'
Archive successfully written to /PWD/system_logs.logarchive
# But:
# OK
$ sudo log repack --predicate 's:^"com.apple.power"' --archive ./system_logs.logarchive
# cleaning up
rm -rf ./system_logs.logarchive ./system_logs_repacked.logarchive
# OK
$ sudo log show --predicate 's:^"com.apple.power"'
# OK
$ sudo log stats --predicate 's:^"com.apple.power"'
# OK
$ sudo log stream --predicate 's:^"com.apple.power"'
Indeed any form of non-NSPredicate crashes it, including simple mistakes like those:
# predicate: =, ==
# shorthand: IS
sudo log collect --predicate 'subsystem IS "com.apple.power"'; rm -rf ./system_logs.logarchive
log: Unable to process predicate: Unable to parse the format string "subsystem IS "com.apple.power""
# Strings need to be quoted; identifiers not
sudo log collect --predicate 'subsystem = com.apple.power'; rm -rf ./system_logs.logarchive
log: Unable to validate mapped predicate
log: failed to create archive: Unknown error: -1 (-1)
You'd think those verbs all share one predicate parsing code…
I recommend that you file a bug about this.
Please post your bug number, just for the record.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"