Time Machine, the always-there, always-ready backup solution included with OS X 10.5, is generally a wonderful tool. Once you’ve connected a drive and set up your backups, Time Machine just works, backing up your machine every hour of every day. Even if you never experience drive failure, Time Machine is also a great tool for recovering from User Failure—I’ve already used it a number of times to get a file back that I really didn’t mean to delete when I did.
One area that’s a bit weak, in my opinion, is in Time Machine’s reporting to the user. If you’d like to see what Time Machine is working on, the only GUI solution is to open up the Time Machine System Preferences panel, where you’ll see either the time of the last and next backups, or if a backup is currently in progress, a progress bar showing how much backup work is left to be done. If you’d like more information than this, though, it appears you’re out of luck.
That’s not entirely true, though. Everything that Time Machine does is logged to the system log, so it is possible to get more detailed reports on its activities. Here are two different ways to use this data to see what Time Machine has been up to.
The simplest way
Open Console, in Applications/Utilties, and if you don’t see a two-column window showing log files in the left-hand panel, then click the Show Log List button in the toolbar. Select the All Messages entry in the left-hand column. The system log works differently in 10.5; it’s now actually a database that can be queried for results, and those results are then displayed in columns in the All Messages section of Console.
To find the activity for Time Machine, you only need to know that the Time Machine process is called
backupd. Click in the search box at the top right of the window (or just press Command-Option-F), then type backupd. As you type, Console will filter the results to only show those entries related to the
backupd process. The filtered output should look something like this:
The results are shown in three columns, as you can see, and it’s the Message column that’s most useful. The messages reveal how much data was backed up, what older backups were removed, and other general information about the backup run.
If you plan on doing this a lot, you can create a database query that you can run without retyping your search each time. Select File -> New Log Database Query, and in the new window that appears, give your query a name (Time Machine activity). In the lower section of the window, leave the first two menus set to Message and Contains, then type backupd in the small text box and click OK. The next time you come back to Console, you can run your query by choosing File -> Open Quickly -> LOG DATABASE QUERIES -> Time Machine activity.
The geeky way
Say you’d like to monitor Time Machine regularly—every time it runs, you’d like to know what it did. In that case, you’ll want something simpler than launching Console and running your saved query every hour. Enter GeekTool.
GeekTool is a System Prefrences panel that we’ve discussed before. Using it, you can output data to windows that sit on your desktop. You can view images from web sites (such as a weather map) or text from files, such as a log file—which is exactly what we’re going to use it for now.
After downloading and installing GeekTool, select it in System Preferences and make sure it’s activated (check the Enable GeekTool box). Click the New Entry button, which will generate a new entry named Console in the Groups window. Double-click on that entry and give it a new name, such as TM Tracking or whatever you like. To the right, click the File pop-up menu and set it to Shell. On the Command tab, set the Refresh field to the delay you’d like before rerunning the command we’re building. As Time Machine only backs up hourly, there’s really no need to have this command run all that often. I have mine set to 1800 seconds (30 minutes), just to account for those times when I manually start Time Machine, or the Mac’s been sleeping, etc.
Next, it’s time to tell GeekTool what we want it to display. In the Command box, enter the following text. Note that this is supposed to be one long line, but I’ve had to break it here so you can see it all. Please remove the line break, and replace it with a space—that is, leave a space after
syslog -F '$Time $Message' -k Sender /System/Library/CoreServices/backupd
-k Time ge -30m | tail -n 10
That looks ugly, but it’s really a bit simpler than it appears.
syslog is a new 10.5 program that’s used to query the log database—just as we did with the GUI in Console earlier. The
-F '$Time $Message' section specifies how the output will appear. In this case, we want to see the time stamp and the message that was returned. The
-k Sender /System... bit specifies which process we’d like to see the output from—that is, which process sent the messages to the database. In this case, that’s the
backupd process, the one that Time Machine uses. The final bit before the pipe symbol (
-k Time ge -30m, specifies a time restriction on the matches—this query will only return log entries made in the last 30 minutes.
Finally, the pipe symbol sends all of the returned matches to
tail -n 10, which will strip out everything except the last 10 lines of the output—I don’t need to see every line that’s been generated, just the end of the file where I can see that the backup finished, and how much space is left on the drive.
Once you have the command entered, you should see output in the default box that GeekTool placed on the screen—if you can’t see the box, click the Always on Top checkbox to make it visible. You can then drag it (and resize it) as you like. Use the ‘Colors and Font’ and Text tabs to customize the display to your liking—note that to really see the effect of your changes, you’ll have to click onto a different entry in the Groups section of GeekTool. If you don’t, you’ll be seeing GeekTool’s highlight color, too, which it uses to show you which display box you’re working on.
With everything set up, here’s how both the GeekTool entry and its output look on my machine—click the image for a larger version in a new window.
Feel free to experiment with the command—change the time interval in the
-k Time ge -30m bit, or the number of lines specified in the
tail -n 10 command. There’s a lot more you can do with
syslog, too, but that’s a topic for another day.