Logging

Authorized Plugin

The authorized plugin portion of Crypt (that handles FileVault Enablement and Key Rotation) logs to Apples new unified logging system. You can view logs during a login or after with the /usr/bin/log command.

To view logs during an enablement, most likely through ssh.

sudo /usr/bin/log stream --level debug --predicate '(subsystem == "com.grahamgilbert.crypt")'

To view logs afterwards.

sudo /usr/bin/log show --predicate '(subsystem == "com.grahamgilbert.crypt")' --style syslog --debug --info --last 24h

Checkin Script

The Checkin portion of Crypt that escrows the key to the server logs to /var/log/crypt.log.