I just noticed that in /var/log/system, latest.log isn't actually the latest.
When/how does log rotation and the creation of the symlink happen, please?
-rw------- 1 root wheel 16854 Aug 30 23:57 system_20230830.log
lrwxr-x--- 1 root wheel 35 Aug 31 11:01 latest.log -> /var/log/system/system_20230830.log
-rw------- 1 root wheel 8438 Aug 31 11:57 system_20230831.log
Once per hour. But it only works after the file was created, which doesn't happen before something is being logged that day for the particular facility.
You can also do it manually from the command line.
# configctl syslog archive
Cheers,
Franco
Perfect, thanks Franco.