Last Week on My Mac: The log is the wrong place

One thing had been puzzling me about the Catalina betas. As you know, I keep a close watch on what’s going on with security data updates, and what I saw seemed wrong. Updates were being downloaded and installed, but when I checked the resulting version numbers of what were actually there, they hadn’t changed at all. It’s a behaviour that I’ve had reported to me, particularly with TCC updates in Mojave, and seems very worrying.

Here’s a system of pushed critical and security updates which operates in near-total silence. If you’re lucky, you might catch a notification that an update has been installed. Otherwise all you can do in macOS is look at the record of installations in System Information. And some very experienced and knowledgeable people have recommended that’s how you can tell whether one of these updates has been successfully applied. Yet here were Macs which said they had installed the update, but whose system files hadn’t changed at all.

There have been other problems too. Back in Sierra, the scheduling service which calls automatic Time Machine backups, DAS (Duet Activity Scheduler), quietly failed after running continously for a few days, and backups suddenly became very infrequent and irregular. No warning was given to the user, and if your backup system was really quiet unlike my rattly old RAID, it might be several days before you noticed that anything was wrong.

These problems have driven me to write several of the free utilities which I offer here: LockRatter, SystHist and most recently SilentKnight for security updates and related information, and T2M2 for Time Machine backups.

In both these cases, and many similar problems which Mac users have come across in recent years, the answers rest buried in the log. Indeed, that’s what T2M2 analyses to discover how your backups have been going, it’s what Cirrus offers to help diagnose iCloud problems, and Taccy shows to help you fix problems with privacy protection in Mojave.

I was thinking about these matters when I was driving, and it occurred to me that my car has a rich collection of different warnings, about the risk of ice, low tyre pressures, seatbelts not being secured, and so on. When things go wrong on my Mac, unless it’s in extremis and ready to fry eggs, it just gets written to the log.

I presume that one or more of the chips in my car’s engine management system keeps some sort of log too, and that when I take it in for service, the garage hooks up to that and looks for signs of problems. But suggesting to any car owner that every so often they should check the logs in their management chips would be quite crazy. So why should I have to do that with my Mac? Why doesn’t it alert me when routine scheduling fails, an important update doesn’t install, or for anything else of significance to me as a user?

This is not through lack of potential. We have alerts, notifications, icons which mysteriously appear for a while in the Dock, menubar tools, and all sorts of ways of attracting the user’s attention. Macs also have very sophisticated monitoring systems such as CoreDuet to keep tabs on every one of the many sensors embedded in their hardware. This isn’t about watching the temperatures of my Mac’s CPUs or its fan speeds, though.

When it comes to warning the user that something hasn’t worked the way that it should have done, all we’re given is some almost incomprehensible entry in a log which few users access, and even if you know what you’re looking for can be a real pain to locate and interpret. That might be a great help to an engineer who knows Macs inside out, but it really doesn’t help the user at all.

I hesitate to suggest that macOS needs yet another sub-system, but it does. It needs somewhere which can collate information about faults, failures and significant errors so that a dashboard can present them intelligibly to the user. When significant problems arise, a notification can draw our attention to that dashboard, and we can be better informed and consider whether to intervene, just as when my car warns me that one tyre has low air pressure. Otherwise we can be driving our Macs around for a long time before we notice the tyre is steadily shredding and about to blow out. What macOS does at present is, in general, too little, too inaccessible, and too late.