system.log (Legacy System Log)

Location

Description

Legacy text-based system log still generated on macOS alongside the Unified Logging system. Captures a subset of system daemon messages, kernel events, and application output in a familiar syslog format with timestamps, process names, and PIDs.

Forensic Value

While largely superseded by the Unified Log, system.log provides a human-readable text log that is easier to parse and search than tracev3 binary logs. It captures service start/stop events, kernel extension loading, network daemon activity, and authentication-related messages. The rotated log archives (.gz) may contain weeks of historical data. On older macOS versions, system.log is the primary system log and contains more comprehensive entries than on modern versions.

Tools Required