Apple has updated the OSX’s logging system in OSX 10.12. The Console.app for viewing logs was also updated and has become pretty much useless. I couldn’t find TimeMachine logs anywhere, for example. It seems that past messages cannot be seen there at all. Luckily there is still a way to see the proper logs in the terminal. This superuser question has answers for how to do that, using the log utility. However, when I tried it locally I only got:

1
2

$ log show --style syslog --info --last 10m --predicate 'processImagePath contains "backupd" and subsystem beginswith "com.apple.TimeMachine"'
log: too many arguments

That was very weird, because even log show reported the same error. Something must be terribly wrong with the system.

After some time, I stumbled upon man zshbuiltins and discovered that log is a built-in command in zsh — and that is why the previous commands didn’t work as expected. If you have the same issue, there are multiple ways to deal with it, a few of them are:

1. Use the full path: /usr/bin/log show --style syslog --info --last 10m --predicate 'processImagePath contains "backupd" and subsystem beginswith "com.apple.TimeMachine"'.

2. Better, create an alias such as: alias llog=/usr/bin/log, and use it: llog show ….

PS. That behavior was taking place a couple of months ago. I tried the same commands today, and the log show command just worked! Moreover, trying to force the built-in command fails:

1
2

$ builtin log show --style syslog --info --last 10m --predicate 'processImagePath contains "backupd" and subsystem beginswith "com.apple.TimeMachine"'
zsh: no such builtin: log

I have not disabled it in any way, however oh-my-zsh could have changed the behavior. I cannot find any disable log, unset log, or anything similar in my zsh dotfiles, and yet if I run zsh without any rc files, log is the builtin there:

1
2
3

$ zsh -f
host% type log
log is a shell builtin

This is a mystery so far! Do you know what happens here?