How to Filter and Stream Live System Logs in macOS Using log stream

Apple’s Unified Logging System (introduced in macOS Sierra) centralized telemetry, diagnostic tracing, and crash reporting across kernel extensions, user-space daemons, and graphical applications. Because the system generates millions of events per hour, viewing raw logs in the Console app can overwhelm developers and administrators. The command-line utility log stream provides high-performance, real-time filtering directly in Terminal using granular predicate queries.

Architecture of the macOS Unified Logging System

The unified logging engine structures events into structured key-value telemetry records:

• Subsystems: Reverse-DNS identifiers identifying the originating software component (e.g., com.apple.TimeMachine, com.apple.securityd).
• Categories: Functional modules within a subsystem (e.g., network, crypto, pairing).
• Log Levels: Includes Default, Info, Debug, Error, and Fault. By default, log stream suppresses ephemeral Debug and Info logs unless explicitly requested.

Basic Real-Time Log Streaming

Launch Terminal and stream raw system events:

log stream

Because this streams hundreds of lines per second, apply immediate targeted filters to capture relevant diagnostic output.

Filtering by Process Name or Process ID

To isolate telemetry generated by a specific application or background daemon:

# Filter by executable name
log stream --process Safari

# Filter by process ID (PID)
log stream --process 12480

This displays all standard and error entries emitted by the target application in real time.

Filtering by Subsystem and Category

To trace specific Apple system frameworks or enterprise security components:

# Stream Wi-Fi framework telemetry
log stream --predicate 'subsystem == "com.apple.wifi"'

# Stream Bluetooth pairing and connection events
log stream --predicate 'subsystem == "com.apple.bluetooth" AND category == "CoreBluetooth"'

# Stream Endpoint Security client notifications
log stream --predicate 'subsystem == "com.apple.endpointsecurity"'

Constructing Advanced NSPredicate Filter Expressions

The --predicate flag supports full Apple NSPredicate syntax, allowing complex boolean logic, wildcards, and message string matching:

# Filter for errors and faults across all subsystems
log stream --predicate 'messageType == error || messageType == fault'

# Search for specific error strings in message content
log stream --predicate 'eventMessage CONTAINS[c] "authentication failed"'

# Stream events from a specific process where level is Error
log stream --predicate 'process == "launchd" AND messageType == error'

Formatting Output for CLI Analysis and Export

Customise log output styling for interactive readability or automated parsing:

# Compact single-line output
log stream --style compact --predicate 'subsystem == "com.apple.securityd"'

# Structured JSON format for ingestion into log pipelines
log stream --style json --process mDNSResponder > /tmp/dns_stream.json

Using log stream with targeted predicates allows rapid root-cause analysis without digging through massive unindexed disk archives.