Quick Answer
To view recent macOS system logs, open Terminal and run:
log show --last 1h
This displays log entries from the last hour. You can narrow the results by process, subsystem, severity, or time period. To watch new entries as they appear, use:
log stream
The macOS log command reads the unified logging system, which combines messages from macOS and apps into a searchable log database.
Before You Begin
The output can be extensive, especially when viewing an hour or more of activity. Start with a short time range and narrow the search when possible.
Terminal commands in this guide only read or display logs unless specifically noted. They do not delete log files or change macOS settings. However, avoid copying sensitive log output into public forums. Logs can contain usernames, file paths, network addresses, device names, or other private information.
If you need to investigate network behavior rather than system messages, see How to Check Open Network Connections on a Mac Using Terminal.
Open Terminal
- Open Finder.
- Select Applications in the sidebar.
- Open the Utilities folder.
- Double-click Terminal.
You can also press Command-Space, type Terminal, and press Return.
Commands are entered at the prompt and run by pressing Return. Terminal may display many lines of output; press Control-C to stop a command that is still running.
View Recent macOS Logs
Show logs from the last hour
The following command displays unified log entries recorded during the previous hour:
log show --last 1h
The --last option accepts a time interval. Common examples include:
log show --last 5m
log show --last 30m
log show --last 2h
log show --last 1d
These commands only retrieve and display information. They do not alter the log database, so there is nothing to reverse.
Limit the results to a shorter period
If the output is too large, use a smaller interval:
log show --last 10m
A shorter time range is usually more useful when you are checking what happened immediately before an app crash, connection problem, or other event.
log show --last 10m
Read long output one screen at a time
For a longer time range, send the output to less:
log show --last 1h | less
Use the following keys inside less:
- Press the Space bar to move down one screen.
- Press the B key to move back one screen.
- Press the Arrow keys to move through the output.
- Press Q to quit.
This command does not modify the logs. It only controls how the output is displayed.
Search Logs for a Specific Term
Search by process or application name
Use --predicate to filter entries. For example, this command searches for messages associated with an application named Safari:
log show --last 1h --predicate 'process == "Safari"'
Replace Safari with the process name you want to investigate. The name must match the process name recorded in the log.
You can also search for a broader text pattern with grep:
log show --last 1h | grep -i "network"
Here, grep -i finds lines containing network without distinguishing between uppercase and lowercase letters.
The two approaches behave differently:
--predicatefilters log records using the unified logging system.grepsearches the text thatlog showprints.
When you know the process name or a structured log field, --predicate is generally more precise. When you are looking for an ordinary word or phrase, grep can be convenient.
Search for error and fault messages
To display messages with an error or fault level, use:
log show --last 1h --predicate 'messageType == "error" OR messageType == "fault"'
This can reduce the amount of output, but an error is not always the cause of a problem. Some errors are expected or harmless, and an important event may be logged at another level.
Search for a phrase
Use grep when you know a word or phrase from an error message:
log show --last 1h | grep -i "permission"
Place the search phrase in quotation marks when it contains spaces:
log show --last 1h | grep -i "disk full"
These commands only display matching lines. They do not remove nonmatching records from macOS.
Watch New Log Entries Live
Use log stream to watch new messages as they are created:
log stream
Unlike log show, which reads existing entries, log stream remains active and waits for new messages.
To stop the stream, press:
Control-C
This stops the display command but does not stop the processes generating the logs and does not delete any entries.
log stream
Stream only messages from a process
To monitor a particular process, use a predicate:
log stream --predicate 'process == "Safari"'
Replace Safari with the process you want to observe. Start the stream immediately before reproducing the problem, then press Control-C after the relevant event appears.
Stream error and fault messages
To watch higher-severity messages as they arrive, run:
log stream --predicate 'messageType == "error" OR messageType == "fault"'
This can still produce frequent output. Add a process or subsystem condition when you know which component is involved.
Filter by Subsystem or Category
macOS and its applications can identify messages with a subsystem and category. If you know those values, filter them with a predicate:
log show --last 1h --predicate 'subsystem == "com.example.app"'
The example uses a placeholder subsystem name. Replace it with the actual value you are investigating; do not expect com.example.app to return useful results on your Mac.
You can search the displayed output for likely subsystem names:
log show --last 1h | grep -i "subsystem"
This is a text search and may not identify every relevant record. For a known subsystem, use the structured predicate instead.
You can combine conditions. For example:
log show --last 1h --predicate 'subsystem == "com.example.app" AND messageType == "error"'
The AND operator requires both conditions to match. You can use OR when either condition is acceptable.
Save a Filtered Log to a File
Saving output can make it easier to review or attach to a private support case. The following command writes the last 30 minutes of output to a file on your Desktop:
log show --last 30m > ~/Desktop/macos-log.txt
The > operator creates the file if it does not exist. If a file with that name already exists, the command replaces its contents.
To avoid overwriting an existing file, use >> to append instead:
log show --last 30m >> ~/Desktop/macos-log.txt
Appending preserves existing contents but can make the file harder to interpret if you run the command repeatedly.
If you created the file and no longer need it, remove it with:
rm ~/Desktop/macos-log.txt
Warning: rm deletes the specified file immediately instead of moving it to the Trash. Confirm the path carefully before pressing Return. If you want to keep the log, do not run this command.
log show --last 30m > ~/Desktop/macos-log.txt
Open the saved file
You can open the file in the default text editor with:
open -a TextEdit ~/Desktop/macos-log.txt
This opens the saved copy and does not change the original unified log database.
Use Timestamps to Define a Precise Range
For a specific investigation, use --start and --end:
log show --start "2025-01-15 14:00:00" --end "2025-01-15 14:15:00"
Replace the example dates and times with the period you need. The exact format is:
YYYY-MM-DD HH:MM:SS
Use a time range that includes the event and a small amount of surrounding activity. If the range is too narrow, you may miss messages that explain what happened immediately beforehand.
You can combine timestamps with a predicate:
log show --start "2025-01-15 14:00:00" --end "2025-01-15 14:15:00" --predicate 'messageType == "error" OR messageType == "fault"'
These commands read records only. No recovery step is needed.
Understand Common Log Fields
A log line can contain several pieces of information:
- Timestamp: When macOS recorded the message.
- Process: The app or system process that generated it.
- Message type: The severity or classification, such as default, info, error, or fault.
- Subsystem: A logical component that produced the message.
- Message: The human-readable description.
Do not assume that the last message shown is the root cause. Logs often include routine status messages, repeated warnings, and follow-up errors. Look for entries that occur immediately before the problem and compare them with what you observed.
Troubleshooting
log: command not found
The log utility is included with macOS. If Terminal reports that it cannot find the command, check that you typed log correctly and that you are using the standard macOS Terminal environment.
The command returns too much output
Reduce the time period:
log show --last 5m
Then add a text filter:
log show --last 5m | grep -i "error"
You can also send the results to less instead of printing everything at once:
log show --last 1h | less
No matching entries appear
The process name, subsystem, phrase, or time range may not match the records. Broaden the search:
log show --last 1h
Then inspect the output for the wording or process name macOS actually uses.
Terminal appears stuck
A command such as log stream is designed to keep running. Press Control-C to stop it. If you used less, press Q.
Logs contain private information
Do not share an unedited log file publicly. Review it first and remove usernames, file paths, network addresses, device names, and other identifying information. Saving logs to the Desktop does not encrypt or otherwise protect the file.
The issue involves storage
System logs can show that a storage-related event occurred, but they may not explain how much space is available or which folders are using it. For folder-level inspection, see How to Compare Folder Sizes in Terminal on a Mac.
Frequently Asked Questions
Does viewing logs delete them?
No. log show and log stream read or display log data. They do not delete entries.
What is the difference between log show and log stream?
log show displays existing records from a selected time range. log stream displays new records as they are generated and continues running until you stop it.
How do I stop a live log stream?
Press Control-C in the Terminal window running log stream. This stops the command, not the underlying macOS service.
Can I view logs from yesterday?
Yes. Use a longer interval:
log show --last 1d
For better precision, use --start and --end with exact timestamps.
Why do I see warnings when nothing is wrong?
Many warnings are routine, expected, or unrelated to the symptom you are investigating. Treat log entries as clues and compare their timestamps with the exact time the problem occurred.
Do I need administrator access?
Basic log viewing usually does not require administrator authentication. Some protected information or system operations may be restricted. Do not bypass a permission prompt unless you understand why it appears and what the command will do.
Final Thoughts
Terminal’s log show command is the simplest way to review recent macOS system activity, while log stream is useful when you can reproduce a problem live. Start with a short time range, filter by a known process or phrase, and stop live monitoring with Control-C. Remember that logs are evidence, not automatic diagnoses, and may include private information.