log: Could not open local log store: The log archive format is corrupt and cannot be read

Solution 1:

The error message you are seeing is very misleading. I believe what's actually happening is the system is preventing unprivileged accounts from reading the log contents. If you instead use sudo to execute the log show command as shown below, you'll get what you want.

Also, the log facility has a built-in method (via the --start and --end command-line switches) to limit the time range of log messages you want.

Give it a shot:

# log show --start "2018-08-01" --end "2018-08-31"

log: Could not open local log store: The log archive format is corrupt and cannot be read

# sudo log show --start "2018-08-01" --end "2018-08-31"

Skipping info and debug messages, pass --info and/or --debug to include.
Timestamp                       Thread     Type        Activity             PID    TTL  
2018-08-01 00:00:00.093146-0700 0x2f722d   Default     0x0                  879    7    com.apple.dock.extra: (CalendarFoundation) [com.apple.calendar:calendar] [com.apple.calendar.foundation.docktile] [[CalDockTileController] dateDidChange: NSCalendarDayChangedNotification]
.
.
.