Unified Logs | macOS High Sierra

I have macOS unified logs from System A in .logarchive format. Any attempts to parse the .logarchive in System B using log show command provides following error:

bash-3.2#log show /tmp/unifiedlogsv2/unifiedlogs.logarchive
        ==========
    /private/tmp/unifiedlogsv2/unifiedlogs.logarchive
        ==========
    log: Archive format needs updating (to version 3), doing so will render the archive unreadable by older tools.
    Re-run log with --force if you want to allow this upgrade

When run with --force option, the following error is displayed:

bash-3.2# log show --force /tmp/unifiedlogsv2/unifiedlogs.logarchive|more
log: warning: The log archive contains partial or missing metadata
log: Could not open log archive: The log archive format is corrupt and cannot be read
==========
/private/tmp/unifiedlogsv2/unifiedlogs.logarchive
==========

The same logarchive opens fine in Console. My objective is to parse the logarchive using the log show command. Any suggestions how to do so?

Solution 1:

The man log page shows two switches, --file file and --archive archive. You will likely need to include one of them when working with archives from another system which didn't originate on the local system.

log show [--archive archive | --file file] [--predicate filter] [--source] [--style default | compact | json | syslog] [--color auto | always | none]
     [--start date/time] [--end date/time] [--[no-]info] [--[no-]debug] [--[no-]signpost] [--last time [m|h|d]] [--timezone local | timezone]

The man page goes on to detail those 2 switches like so:

    --archive archive
                     Display events stored in the given archive. The archive 
                     must be a valid log archive bundle with the suffix
                     .logarchive.

    --file file      Display events stored in the given .tracev3 file. In order 
                     to be decoded, the file must be contained within
                     a valid .logarchive bundle, or part of the system logs 
                     directory.

Example

Since you're working with .logarchive formatted files you likely want to use the --archive switch:

$ log show --archive /tmp/unifiedlogsv2/unifiedlogs.logarchive