Querying the unified log on macOS: log show, log stream and predicates

Goal

Find the relevant lines in macOS's unified log — a binary, compressed store, not a text file — without opening the Console app.

Prerequisites

Terminal access; sudo for logs from other users' sessions or some system subsystems.

Steps

1. Show recent history: log show --last 1h --predicate 'process == "sshd"' prints matching entries from the last hour without a live session.
2. Narrow by subsystem and category, more precise than filtering on raw text: log show --last 30m --predicate 'subsystem == "com.apple.network" AND category == "connection"'.
3. Follow new entries as they arrive, useful while watching a job run: log stream --predicate 'process == "installd"' --level debug.
4. Get machine-readable output for a script or log pipeline: add --style json (or ndjson) to either subcommand.
5. Include debug- and info-level messages, hidden by default: add --debug --info.
6. Before wiping a machine, or for an incident that already happened, bundle the log store for later analysis: sudo log collect --last 24h --output incident.logarchive; open the result in Console, or query it elsewhere with log show --archive incident.logarchive.

Expected result

Matching lines print to stdout in the chosen style; an empty result with exit status 0 means the predicate matched nothing, not that logging is broken — widen the time window or predicate first.

Limits and test basis

Predicate syntax, --last, --style and log collect come from a command reference, since Apple does not publish log's command-line flags as a web page. The privacy behaviour is documented in Apple's developer documentation on generating log messages: dynamic string and object values are redacted to <private> by default unless the logging code explicitly marks them public, or a debug/private-data profile is installed. A redacted field cannot be recovered by re-querying with different flags — the value has to have been logged as public, or with the hash mask, in the first place.