Where Are macOS Log Rotation Rules?
macOS rotates system logs through newsyslog.conf rules, with compressed archives beside live logs.
Last updated
macOS rotates logs with newsyslog, driven by a config file listing each log's size, count, and compression rules. Rotated archives sit beside the live log with numeric suffixes.
That pairing explains disk mysteries in /var/log. A huge live log means its rule never fires; a folder of archives means it fires constantly. Read the config for the cadence, then adjust counts before deleting archives by hand.
Where macOS stores this, by platform
/etc/newsyslog.conf
Rotation rules per log file as plain text. Edit counts and sizes here rather than deleting archives manually.
Frequently asked questions
How do I change log rotation for a service?
Edit the matching rule in newsyslog.conf and signal syslogd. Count, size, and compression settings per log live there as plain text.
Notice an outdated path? Let us know.