Analysis & Correlation of Mac Logs - SANS

BZip2 Decompression
Use bzcat on OS X
(oldest -> newest)
system.log.7.bz2 -> system.log.0.bz2
1. bzcat system.log.7.bz2 system.log.
6.bz2 system.log.5.bz2 system.log.
4.bz2 system.log.3.bz2 system.log.
2.bz2 system.log.1.bz2 system.log.
0.bz2 >> system_all.log!
2. cat system.log >> system_all.log!
oompa@csh.rit.edu | @iamevltwin