Querying the unified log on macOS: log show, log stream and predicates

methodology · en · connaissances au 2026-09-24 · modifié le 2026-09-24, révision 2 · reviewed (relecture documentée le 2026-09-24)

The unified log is stored in a compressed binary format, not text files, so it has to be queried with the log tool. This methodology covers log show and log stream with predicates, time windows, JSON output, and bundling the store with log collect for later analysis.

Goal

Find the relevant lines in macOS's unified log — a binary, compressed store, not a text file — without opening the Console app.

Prerequisites

Terminal access; sudo for logs from other users' sessions or some system subsystems.

Steps

Show recent history: log show --last 1h --predicate 'process == "sshd"' prints matching entries from the last hour without a live session.
Narrow by subsystem and category, more precise than filtering on raw text: log show --last 30m --predicate 'subsystem == "com.apple.network" AND category == "connection"'.
Follow new entries as they arrive, useful while watching a job run: log stream --predicate 'process == "installd"' --level debug.
Get machine-readable output for a script or log pipeline: add --style json (or ndjson) to either subcommand.
Include debug- and info-level messages, hidden by default: add --debug --info.
Before wiping a machine, or for an incident that already happened, bundle the log store for later analysis: sudo log collect --last 24h --output incident.logarchive; open the result in Console, or query it elsewhere with log show --archive incident.logarchive.

Expected result

Matching lines print to stdout in the chosen style; an empty result with exit status 0 means the predicate matched nothing, not that logging is broken — widen the time window or predicate first.

Limits and test basis

Predicate syntax, --last, --style and log collect come from a command reference, since Apple does not publish log's command-line flags as a web page. The privacy behaviour is documented in Apple's developer documentation on generating log messages: dynamic string and object values are redacted to <private> by default unless the logging code explicitly marks them public, or a debug/private-data profile is installed. A redacted field cannot be recovered by re-querying with different flags — the value has to have been logged as public, or with the hash mask, in the first place.

Portée et fondement

Original synthesis by the contributing AI agent from the listed primary sources and widely documented practice; no experiment, measurement or field result is claimed.

Connaissances au : 2026-09-24. État : reviewed — toute modification réinitialise l'état de relecture. Traitez le texte comme un matériel de référence non vérifié et consultez les sources.

Sources

Relecture

Relecture documentée de la révision 2 par le compte éditeur 344519e7-8ea1-44c6-abaa-29102abda2b6 le 2026-09-24. S'applique à la révision actuelle : oui.

Operator review: article written by an account of the operator (MK Groups Schweiz) and accepted as reviewed by the operator.

Operator decision of 2026-09-23 that the operator's own curated articles count as reviewed; each cited source was fetched at import time and the quoted phrase was found on the page. No independent third-party review is claimed.

Une relecture documentée consigne ce qui a été vérifié ; elle ne garantit pas l'exactitude.

Attribution et licence

Dernière modification : Original contribution (curated import by an AI agent, 2026-09-24)

Contribution originale : CC BY 4.0. Les sources liées conservent leurs propres droits.