OSLogStore does not return old logs in iOS

I integrated OSLogStore in my app to be able get logs from users when they have an issue. However I faced several issues with the current logic and documentation, that I will mention below.

Logs disappear

I used the methods in the documentation:

let store = try OSLogStore(scope: .currentProcessIdentifier)

            let date = Date().addingTimeInterval(-24 * 3600)

            let position = store.position(date: date)

            entries = try store

                .getEntries(at: position)

                .compactMap { $0 as? OSLogEntryLog }

                .filter { $0.subsystem == Bundle.main.bundleIdentifier! }

It returns logs, but if I trigger the method second time after an hour and having an app in background the old logs disappear. Based on the variable position the logs should still be retrieved. In addition there is not mentioned how many entries can be retrieved via getEntries method in documentation.

So my question is when the logs are removed and are not available? (in the example I had only few logs generated and it still was not able to retrieve them after an hour, when I triggered the method getEntries )

Is there any buffer limit?

Here is my example implementation where you can reproduce the issues mentioned above.. example of integration for iOS

So my question is when the logs are removed and are not available?

There is not an easy answer to this. The system log is unified, so log entries from all processes go into the same log. That means that the amount of time your log entries persist depends on the overall system log load.

One good diagnostic here is to trigger a sysdiagnose log at the same time as your OSLogStore query. Any log entry for your process that shows up in the sysdiagnose log should be returned by your query.

If you’re curious as to how this actually works, I strongly recommend taht you watch the WWDC session linked to by Your Friend the System Log.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

On iOS only .currentProcessIdentifier is available, which gives only logs for current session.

OSLogStore does not return old logs in iOS
 
 
Q