Skip to content

View app-specific log messages in Terminal

March 29 2018 Update:

When this tip was first posted, it didn't work right: The log command ignored the --start, --end, and --last parameters. Regardless of what you listed for parameters, you'd always get the entire contents of the log file. I'm happy to note that this has been resolved in macOS 10.13.4, as log now functions as expected:

$ log show --last 20s --predicate 'processImagePath CONTAINS[c] "Twitter"'
Filtering the log data using "processImagePath CONTAINS[c] "Twitter""
Skipping info and debug messages, pass --info and/or --debug to include.
Timestamp                       Thread     Type        Activity             PID    TTL  
2018-03-30 09:26:15.357714-0700 0xc88a8    Default     0x0                  5075   0    Twitterrific: (CFNetwork) Task <9AD0920A-7AE7-4313-A727-6D34F4BBE38F>.<250> now using Connection 142
2018-03-30 09:26:15.357742-0700 0xc8d7a    Default     0x0                  5075   0    Twitterrific: (CFNetwork) Task <9AD0920A-7AE7-4313-A727-6D34F4BBE38F>.<250> sent request, body N
2018-03-30 09:26:15.420242-0700 0xc88a8    Default     0x0                  5075   0    Twitterrific: (CFNetwork) Task <9AD0920A-7AE7-4313-A727-6D34F4BBE38F>.<250> received response, status 200 content K
2018-03-30 09:26:15.420406-0700 0xc8d7a    Default     0x0                  5075   0    Twitterrific: (CFNetwork) Task <9AD0920A-7AE7-4313-A727-6D34F4BBE38F>.<250> response ended
 --------------------------------------------------------------------------------------------------------------------
Log      - Default:          4, Info:                0, Debug:             0, Error:          0, Fault:          0
Activity - Create:           0, Transition:          0, Actions:           0
$

This makes it really easy to get just the time slice you need from the overly-long log files. You can use s for seconds, m for minutes, h for hours, and d for days as arguments to these parameters.

This article provides a nice overview on interacting with log and predicates to filter the output—there's a lot you can do to help figure out what might be causing a problem.

And now, here's the rest of the original post…

It's not often I get to use a tweet by Many Tricks own Peter Maurer as the inspiration for a tip. But this tip is such a case, as he recently complained about Console and its inability to see old output. A response from @fzwob taught me something I didn't know:

That command browses the captured macOS log data and pulls out anything that matches the specified process name. This could be useful if you're having troubles with an app and wonder if anything was logged relative to your troubles. Or you might be asked to send the log data if you're working with the developer on your issue.

Unfortunately, the quotes and dashes in the command as tweeted have been prettified (by Twitter?); here it is in raw Terminal form, using our own Moom as an example:

log show --predicate 'processImagePath CONTAINS[c] "Moom"'

When you press Return, the command will start digging into the log file, and soon start spewing output—possibly a lot of output—to your screen.

Once the log file has been completely searched for your specified process, you'll get the command prompt back.

To help trim the output, you can search for entries just from a given date or dates by adding --start and/or --end options to the command, like this:

log show --predicate 'processImagePath CONTAINS[c] "Moom"' --start "2017-03-18" --end "2017-03-22"

But just having this output in Terminal isn't much help, especially if you need to send it to a developer. To capture the output to a file and see it onscreen, you need to pipe it to the tee command. For example, to capture the above date-specific search to a file named output.txt on your Desktop, you'd use this command.

log show --predicate 'processImagePath CONTAINS[c] "Moom"' --start "2017-03-18" --end "2017-03-22" | tee ~/Desktop/output.txt

You'll still see lots of output fly by in Terminal, but it will also be captured to the specified file. If you don't want to see it onscreen, you can just redirect the output, like this:

log show --predicate 'processImagePath CONTAINS[c] "Moom"' --start "2017-03-18" --end "2017-03-22" > ~/Desktop/output.txt

I doubt I'll need this command often, but it's nice to know you can get app-specific data from the log system.

1 thought on “View app-specific log messages in Terminal”

Comments are closed.