Mac® Security Bible

19.3. Finding Logs

Almost all logs are stored in one of three places, so if you want to locate them manually, back them up, copy them, or do anything else with them, those are the spots where you should look. However, if you simply want to read the logs, you need not access them directly in the Finder — instead, use Console, as described next. Here's where you can find logs:

• /var/log. This folder, normally hidden in the Finder, contains logs for most of Mac OS X's system processes as well as for some third-party software that operates at a relatively low level — security-related software often falls into this category. To view the contents of this folder, type cd /var/log either in Terminal or in the Finder, choose Go Go to Folder, type /var/log as shown in Figure 19.1, and then click Go.

  Figure 19.1. To view logs stored in the hidden /var/log folder, use the Finder's Go to Folder command.

  

• /Library/Logs. This folder contains logs for a relatively small number of applications and processes that affect all user accounts. Backup programs and software update utilities often use this folder.

• ~/Library/Logs. Each user has a Logs folder in his or her individual Library folder. These Log folders contain most of the logs for third-party applications, noting the behavior of those applications ...