macOS relies on a unified logging system that captures millions of events, errors, and system messages in the background. While Apple provides the graphical Console app to read these logs, system administrators and power users often find it slow and difficult to filter through massive amounts of data.
The log show command in the macOS Terminal is the most powerful way to access, filter, and analyse system logs directly from the command line. It allows you to pinpoint specific application crashes, kernel panics, network issues, and security events without being overwhelmed by unrelated system noise.
Understanding the macOS Unified Logging System
Unlike older UNIX systems that stored logs in plain text files inside the /var/log directory, modern macOS stores logs in a compressed, binary format. You cannot simply open these files with a text editor like nano or cat.
The log utility is the official interface required to read, query, and extract data from this binary database. Because the unified logging system captures an enormous amount of diagnostic data, running a raw query will flood your terminal screen. Therefore, learning how to filter the output is essential.
Basic Usage of log show
The most fundamental command to view recent logs is log show. However, because it reads the entire history, you must always restrict the timeframe to avoid locking up your terminal.
To view all system logs generated within the last 10 minutes, open your Terminal and type:
log show --last 10m
You can adjust the time parameter using s for seconds, m for minutes, h for hours, and d for days (e.g., --last 2h or --last 1d).
Filtering Logs with Predicates
The true power of log show lies in its ability to filter results using predicate queries. Predicates allow you to search for specific processes, message types, or subsystems.
Filtering by Process Name
If a specific application is crashing or misbehaving, you can isolate logs generated only by that application. Use the process key in your predicate.
For example, to view logs generated by the Safari browser in the last hour, run:
log show --predicate 'process == "Safari"' --last 1h
Filtering by Message Content
If you are looking for a specific error code or keyword within the log messages, use the eventMessage key combined with the CONTAINS operator.
To search for logs containing the word “error” or “failed” related to Wi-Fi, you can structure your query like this:
log show --predicate 'eventMessage CONTAINS "Wi-Fi" AND eventMessage CONTAINS "failed"' --last 24h
Filtering by Subsystem
macOS developers organise logs into logical subsystems (e.g., networking, Bluetooth, power management). If you are troubleshooting a specific hardware component, filtering by subsystem provides highly relevant results.
To view logs related exclusively to Bluetooth connectivity over the last 30 minutes:
log show --predicate 'subsystem == "com.apple.bluetooth"' --last 30m
Formatting and Exporting Log Output
By default, log show outputs a highly detailed, multi-line format that can be difficult to read quickly. You can change the output style to suit your needs.
Using the Default Syslog Format
If you prefer the traditional, single-line format used by older UNIX syslog implementations, use the --style flag:
log show --style syslog --last 15m
This compresses the output, making it much easier to scan visually for anomalies.
Exporting Logs to a File
When you need to share logs with a developer, an IT helpdesk, or Apple Support, you should export the filtered results to a text file rather than taking screenshots.
You can redirect the output of any log show command to a file using the standard > operator. For example, to save the last hour of kernel logs to your desktop:
log show --predicate 'process == "kernel"' --last 1h > ~/Desktop/kernel_logs.txt
Viewing Live Logs in Real-Time
While log show is used to review historical data, you may sometimes want to watch logs as they happen in real-time (similar to the traditional tail -f command). For this, use the log stream command instead.
To watch real-time logs for a specific application while you reproduce an error:
log stream --predicate 'process == "Mail"'
Press Control + C to stop the live stream when you have captured the necessary information.