Reading macOS Logs Like a Pro — Console.app and Beyond

When something misbehaves on macOS, the answer is usually in a log — buried under thousands of lines scrolling past in Console.app. Here's how to actually find it.

The unified logging system

Since macOS Sierra, system and app logs flow through unified logging. Key concepts:

• Subsystem — reverse-DNS identifier, e.g. com.apple.network
• Category — a subsystem's sub-channel
• Level — fault, error, default, info, debug

Useful log commands

# Stream errors from one process
log stream --predicate 'process == "MyApp"' --level error

# Show the last hour of faults
log show --last 1h --predicate 'messageType == fault'

Predicates are powerful but verbose — and the output is still a wall of text.

When files are the source

Crash reports live in ~/Library/Logs/DiagnosticReports; many apps also write plain .log files to ~/Library/Logs. The pain points are always the same: huge files, mixed formats, and no way to filter by severity across sources.

A purpose-built viewer

LogStudio parses log files into structured, filterable tables — severity colors, instant search, timeline jumps — so a 500 MB log stops being a wall of text and becomes something you can actually interrogate.