How to Search macOS Logs for Errors Using the log Command

Quick Answer

Use the log command in Terminal to search macOS’s unified log for messages that match an error, process, subsystem, or time range. For example:

log show --last 1h --predicate 'eventMessage CONTAINS[c] "error"' --info

This displays log entries from the last hour whose message contains “error,” without changing system settings or deleting logs. Replace the search term, time range, or predicate to investigate a specific app or problem.

What the log Command Does

macOS uses a unified logging system to collect messages from the operating system, apps, and services. The log command lets you inspect that information from Terminal.

Two subcommands are especially useful:

• log show searches log entries that have already been recorded.
• log stream displays new log entries as they are generated.

You can filter results by time, process, subsystem, message text, and log level. Because logs can be extremely detailed, filtering is usually more useful than displaying everything.

The commands in this guide search or monitor logs. They do not delete log data or change macOS settings. However, avoid copying sensitive log output into public forums: entries can include usernames, file paths, device names, network addresses, or information about the apps you use.

If you need a broader introduction to displaying recent entries, see How to View Recent macOS System Logs Using Terminal.

Open Terminal and Check the Command

1. Open Terminal from Applications > Utilities.
2. Run this command to display the available log help:

log help

This prints the main log subcommands and options. It does not alter logs or system behavior.

To see help for the search command, run:

log show --help

The help text can vary with the macOS release installed on your Mac, so it is a useful reference when an option behaves differently than expected.

Search Recent Logs for Error Messages

Start with a limited time range. This command searches the last hour for entries whose message contains error, without regard to capitalization:

log show --last 1h --predicate 'eventMessage CONTAINS[c] "error"' --info

What the options mean:

• show searches stored log entries.
• --last 1h limits the search to the previous hour.
• --predicate applies a filter.
• eventMessage is the text of the log message.
• CONTAINS[c] searches for text without case sensitivity.
• "error" is the search term.
• --info includes informational messages in addition to the default entries.

The command may return no results. That does not necessarily mean nothing went wrong. The relevant event may use different wording, may be outside the selected time range, or may not be available to your user account.

For a wider search, change the time range:

log show --last 24h --predicate 'eventMessage CONTAINS[c] "error"' --info

Long searches can produce substantial output. You can stop a running command safely by pressing Control- C in Terminal. This stops the display operation; it does not remove the log entries.

Search for a Specific App or Process

If one app appears to be causing the problem, search for its process name. For example, this command searches for messages associated with an application process named Safari:

log show --last 1h --process Safari --info

Replace Safari with the process name you want to investigate. The process name is not always identical to the app’s display name. If this returns nothing, search the message text instead:

log show --last 1h --predicate 'eventMessage CONTAINS[c] "Safari"' --info

You can combine a process filter with an error-message filter:

log show --last 1h --process Safari --predicate 'eventMessage CONTAINS[c] "error"' --info

This narrows the results to entries associated with that process and containing the selected word.

To search for a particular subsystem, use a predicate such as:

log show --last 1h --predicate 'subsystem == "com.apple.some-subsystem"' --info

Do not copy the example subsystem name as though it identifies a real service. Replace it with a subsystem value found in your own log output or documentation. A predicate that does not match an existing subsystem simply returns no entries.

Search by Log Level

Log records can have different levels, including debug, info, notice, error, and fault. To look for entries at the error level, use:

log show --last 1h --predicate 'messageType == error' --info

To search for both errors and faults:

log show --last 1h --predicate 'messageType IN {error, fault}' --info

This is different from searching for the word error in the message. A message can describe an error without being classified at the error level, and an error-level entry may not contain that word.

For practical troubleshooting, try both approaches:

1. Search the message text for a term related to the symptom.
2. Search the log level for error and fault.
3. Compare the timestamps with the moment the problem occurred.

Search Around the Time a Problem Happened

A relative range such as --last 1h is convenient, but a narrow interval can be more useful when you know approximately when the failure occurred.

Use --start and --end with date and time values accepted by your Mac:

log show --start "2025-01-15 10:00:00" --end "2025-01-15 10:15:00" --predicate 'eventMessage CONTAINS[c] "error"' --info

Replace the example date and times with the period you want to inspect. The date shown here is only an example; do not assume it represents your incident.

If you are unsure of the exact time, search a larger window first:

log show --last 6h --predicate 'eventMessage CONTAINS[c] "error"' --info

Then note the timestamps of relevant entries and repeat the search with a narrower interval.

Watch for New Errors with log stream

log show searches entries already stored. log stream watches for new entries while the command is running.

This command displays new messages containing error:

log stream --predicate 'eventMessage CONTAINS[c] "error"' --info

Run it immediately before reproducing the problem. For example:

1. Start the command.
2. Reproduce the app failure or system behavior.
3. Return to Terminal and review the entries that appeared.
4. Press Control- C to stop the stream.

Stopping the stream is safe. It ends monitoring but does not change the app or delete any records.

To monitor one process:

log stream --process Safari --info

To monitor only error and fault levels:

log stream --predicate 'messageType IN {error, fault}' --info

Streaming can be noisy, especially when monitoring the whole system. Use the narrowest filter that matches your investigation.

Save Search Results to a File

If the output scrolls too quickly, redirect it to a file in your home folder:

log show --last 1h --predicate 'eventMessage CONTAINS[c] "error"' --info > ~/Desktop/macos-errors.txt

The > operator writes the command’s output to macos-errors.txt on your Desktop. If a file with that name already exists, this command replaces its contents. To avoid overwriting an existing file, use a different filename or append with >>:

log show --last 1h --predicate 'eventMessage CONTAINS[c] "error"' --info >> ~/Desktop/macos-errors.txt

Appending preserves existing contents but can make the file harder to read if you repeat the command many times.

Open the saved file in the default text editor with:

open ~/Desktop/macos-errors.txt

These commands create a text file; they do not modify macOS logs. When you no longer need the file, delete it from the Desktop in Finder or run:

rm ~/Desktop/macos-errors.txt

rm permanently removes the specified file without moving it to the Trash. Before running it, confirm that the path contains only the disposable log copy you created. If you want a recoverable option, delete the file through Finder instead.

Make Results Easier to Read

For a simple text view without the usual extra formatting, use --style compact:

log show --last 1h --style compact --predicate 'eventMessage CONTAINS[c] "error"' --info

You can also page through long output one screen at a time:

log show --last 1h --predicate 'eventMessage CONTAINS[c] "error"' --info | less

Use the arrow keys or Page Up and Page Down to move through the results. Press q to quit less. The pipe sends the search results to the less viewer; it does not save or alter them.

If you need to search within the displayed results, press /, type a term, and press Return. Press n to move to the next match.

A Practical Error-Searching Workflow

Use this sequence when diagnosing an app crash, failed connection, storage warning, or another problem:

1. Record the symptom. Note which app or feature failed and approximately when.
2. Search a short period. Start with --last 1h or another appropriate range.
3. Search the app or service. Use --process or a predicate for the app name.
4. Search relevant terms. Try words such as error, failed, timeout, or a distinctive message from the symptom.
5. Compare timestamps. Look for entries created at the same time as the failure.
6. Repeat the action. Use log stream if the issue is easy to reproduce.
7. Save useful results. Redirect only the relevant search to a text file.
8. Protect private information. Remove usernames, paths, addresses, and other identifying details before sharing output.

A log entry is evidence about what a service reported, not automatically the root cause. Many entries are routine, repeated, or unrelated to the visible problem. Look for a consistent relationship between the event, the timestamp, and the behavior you are troubleshooting.

Troubleshooting

The command returns no results

Widen the time range, change the search term, or remove a filter:

log show --last 6h --info

This can produce a large amount of output, so use it only as a broader diagnostic step. You can then identify a process or phrase and rerun a narrower search.

The output is too large

Use several filters together:

log show --last 1h --predicate 'messageType IN {error, fault} AND eventMessage CONTAINS[c] "network"' --info

Replace network with a term related to your problem. Narrowing the time range is often more effective than searching a full day.

The process filter does not work

The process name may differ from the app name. Search the message text or inspect a small set of recent entries to identify the process:

log show --last 10m --info

Then stop the command with Control- C if the output becomes excessive.

Terminal reports an invalid predicate

Check quotation marks and predicate field names. Use straight single quotes around the complete predicate, and use straight double quotes around text values:

log show --last 1h --predicate 'eventMessage CONTAINS[c] "timeout"' --info

Avoid replacing these quotation marks with typographic “smart quotes” copied from a formatted document.

You cannot see the details you expected

Some information may be private, unavailable to your account, or retained only for a limited period. Avoid using sudo casually. Elevated access can expose more system information, but it does not guarantee that every event is available, and it increases the amount of sensitive data displayed.

If the issue involves an unresponsive app or process, use a separate process-focused method rather than treating every log entry as the cause. For example, How to Use ps, top, and kill to Troubleshoot Apps on a Mac explains how to inspect and manage active processes.

Frequently Asked Questions

Does searching logs delete anything?

No. log show reads stored entries, and log stream observes new entries. Redirecting output to a file creates a separate copy.

Can I search all of macOS’s logs at once?

You can search a broad time range, but the results may be very large and difficult to interpret. Start with a short period and a specific process, subsystem, or message term.

What is the difference between error and fault?

They are log message levels. An error indicates a problem was reported; a fault generally represents a more serious condition. Neither level alone proves that the entry caused your symptom.

Should I share complete log output online?

Usually not. Review the output first and remove personal paths, usernames, network information, device names, and other sensitive details.

How do I stop a search or live stream?

Press Control- C while Terminal is active. This stops the current command without deleting logs or changing system settings.

Final Thoughts

The log command is most useful when you search a short time range and combine it with a meaningful process, message term, or log level. Start with log show, use log stream when reproducing a problem, and treat matching entries as clues that must be compared with the actual symptom.