[chasejamf]

Hi, I'm trying to figure out if my system (OS X 10.2.8) keeps a log of connected devices. (Specifically an iPod connected a month ago.) Does OS X have this feature? Hopefully it would capture the name and I can prove that this iPod was either a stolen item or not. Any help is greatly appreciated.

[Peter753]

Hey, I don't mean to be rude as I'm replying and can't really help you out, but I'd be interested in hearing the story of the stolen iPod.

[Detrius]

Since it was a month ago, it's too long. But to answer the original question, it's in /var/log/system.log (along with a LOT of other stuff). Every day, the log is changed out, but only a week of logs are kept. So, the fact that you are trying to look a month back means you won't find it here--and that's the only place I know of.

[rem]

Oops, all this time I thought OS X created gzipped archives of system logs each time /etc/monthly (or whichever script that rotates logs) is run.

[chasejamf]

Thank you for the reply, Detrius. I appreciate your help.

[Ganesha]

If you keep your mac off/sleep overnight, you should check the system logs anyway (since you are running 10.2.8, you can miss rollovers if you mac isn't on.)

[Detrius]

Originally Posted by rem

Oops, all this time I thought OS X created gzipped archives of system logs each time /etc/monthly (or whichever script that rotates logs) is run.

It does create gzipped archives, but for the really busy log files (like system.log), it does it on a daily basis.


And good point about the 10.2.8 thing... they may still be there.

[chasejamf]

I checked, it had been erased already. Thanks for the help, everyone. Learned something new anyway!