macOS Unified Logging — JSON event

macOS Unified Logging — JSON event. Unified Logging exposes structured application and operating-system messages with subsystem and process context.

Source and collection

Unified log store; log show or log stream JSON output, subject to OS version, permissions and privacy redaction.

Select a bounded time interval and predicate. Preserve the exact log output style; private fields may remain redacted.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — line 1

One complete record selected; values unchanged.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: 49ab0c7d7101b3667ab5105bd696d1c8d557ba8a8db102d616c2d6a0f981128e

{"timezoneName":"","messageType":"Default","eventType":"logEvent","source":null,"formatString":"%s | ApplicationManager: Checked in app : %@","userID":501,"activityIdentifier":0,"subsystem":"com.apple.loginwindow.logging","category":"Standard","threadID":13692,"senderImageUUID":"2F16B6B6-41B5-34D4-88A1-06CAFCE952EF","backtrace":{"frames":[{"imageOffset":109999,"imageUUID":"2F16B6B6-41B5-34D4-88A1-06CAFCE952EF"}]},"bootUUID":"","processImagePath":"\/System\/Library\/CoreServices\/loginwindow.app\/Contents\/MacOS\/loginwindow","senderImagePath":"\/System\/Library\/CoreServices\/loginwindow.app\/Contents\/MacOS\/loginwindow","timestamp":"2025-10-09 12:02:22.345217+0530","eventMessage":"-[SessionLogoutManager buildSessionDictionary] |      final sessionDictionary:{\n    DirectLogoutType = 5;\n    GroupID = 248;\n    GuestAccount = 0;\n    HomeDirectoryPath = \"\/var\/setup\";\n    SessionAgentPID = 100;\n    UserGUID = \"FFFFEEEE-DDDD-CCCC-BBBB-AAAA000000F8\";\n    UserID = 248;\n    UserLongName = \"Setup User\";\n    UserName = \"_mbsetupuser\";\n}","processImageUUID":"2F16B6B6-41B5-34D4-88A1-06CAFCE952EF","traceID":3714562696282116,"processID":1062,"senderProgramCounter":109999,"parentActivityIdentifier":0}

Structure and field interpretation

Observed structure in this specific sample
Field/path	Serialized type
`timezoneName`	str
`messageType`	str
`eventType`	str
`source`	NoneType
`formatString`	str
`userID`	int
`activityIdentifier`	int
`subsystem`	str
`category`	str
`threadID`	int
`senderImageUUID`	str
`backtrace.frames`	array
`backtrace.frames[0].imageOffset`	int
`backtrace.frames[0].imageUUID`	str
`bootUUID`	str
`processImagePath`	str
`senderImagePath`	str
`timestamp`	str
`eventMessage`	str
`processImageUUID`	str
`traceID`	int
`processID`	int
`senderProgramCounter`	int
`parentActivityIdentifier`	int

timestamp: Event timestamp in the serialized record.
subsystem / category: Producer-defined classification.
eventMessage: Rendered message, potentially privacy-redacted.
processID: Process identifier; correlate with time and host.

Investigation uses

Filter authentication-related subsystems and correlate with endpoint process evidence.
Compare process ID, subsystem, category and event message to reconstruct a bounded timeline.

Validation boundaries

Unified logs are not a complete process-audit feed; timestamps, field availability and privacy behavior vary by release.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

References

Logging | Apple Developer Documentation

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.