The system log on macOS is a record of operational events generated by the operating system, applications, and hardware components. It captures boot sequences, service startups, crashes, authentication attempts, and error messages, serving as a diagnostic tool for identifying issues.
System log entries are stored in structured binary files managed by the asl (Apple System Log) daemon. These logs are indexed and searchable via the Console application, which provides a graphical interface to filter, search, and analyze events in real time or from historical records.
Logs are categorized by severity: debug, info, notice, warning, error, and critical. Entries include timestamps, process IDs, hostnames, and messages. For example, a failed login attempt appears as:
Jan 15 08:32:17 MacBook-Pro login[123]: Failed password for user 'alice' from 192.168.1.100This entry shows the date, time, process (login), user, and source IP-critical for detecting unauthorized access.
When a process runs on macOS, it may send messages to the system log using the syslog() function. The asl daemon collects these messages, stores them in compressed binary format under /var/log/, and makes them available through the Console app.
Log files are rotated daily and retained for up to seven days by default. Older logs are archived and compressed. The system uses log command-line tools to query logs directly. For example:
log show --predicate 'subsystem == "com.apple.securityd"' --last 1hThis command retrieves all security-related events from the last hour. The --predicate flag filters based on subsystem, process, or message content.
Console.app offers real-time monitoring. Open it from Applications > Utilities, then select System Reports or Recent Logs to view live activity. You can also search by keyword, filter by process, or export logs for analysis.
System logs originate from multiple sources. The most common are:
| Source | Type | Example Entry | Purpose |
|---|---|---|---|
kernel |
Hardware/System Events | Jan 15 08:31:45 kernel[0]: AppleIntelCPUPowerManagement: CPU idle state changed |
Tracks CPU power states, thermal events, and driver interactions. |
securityd |
Authentication & Security | Jan 15 08:32:17 securityd[123]: Login failure for user 'alice' |
Records failed logins, firewall changes, and encryption key events. |
launchd |
Service Management | Jan 15 08:33:01 launchd[1]: Job failed to start: com.apple.screensharing |
Logs startup failures for background services and daemons. |
WindowServer |
Graphics & Display | Jan 15 08:34:12 WindowServer[456]: Display resolution changed to 1920x1080 |
Documents display configuration changes and graphics driver errors. |
Each entry includes metadata such as the process ID, hostname, and log level. The syslog facility codes define categories: auth for login events, daemon for system services, local0-7 for custom apps.
Many users assume system logs are only useful for advanced troubleshooting. This is incorrect. Even basic users can benefit from reviewing logs when apps crash or Wi-Fi drops.
A frequent mistake is confusing system.log with console.log. The former is a legacy plain-text file located at /var/log/system.log. It's outdated and not updated in real time. Modern macOS uses the asl database, which Console.app accesses directly. Relying on system.log may miss recent or filtered entries.
Another misconception: logs are always secure. They are not. While access is restricted to authenticated users, anyone with admin rights can read them. Sensitive data like passwords or tokens may appear in plaintext during debugging. Always disable verbose logging in production environments.
I once diagnosed a Mac that repeatedly froze during startup. The system log showed repeated kernel entries:
Jan 15 08:31:45 kernel[0]: panic(cpu 0 caller 0xffffff7f8c123456): "Kernel trap at 0xffffff7f8c123456, type 14=page fault" For developers, logs help debug app behavior. A web server app failing to bind to port 8080 returned:
Jan 15 08:35:00 MyApp[789]: Error: bind() failed: Permission denied (errno 13)Checking the auditd log revealed the app lacked com.apple.developer.networking.networking entitlements. Adding the required privilege fixed the error.
Always use Console.app instead of manually reading /var/log/system.log. It supports filtering, color-coding, and searching across all log streams.
Set up log monitoring for recurring issues. Use the log command in scripts to detect anomalies. For example:
log show --predicate 'eventMessage contains "crash"' --last 24h | grep -i "error"This finds crash reports from the past day and highlights errors.
Clear logs periodically to prevent disk space issues. The log utility can purge old entries. Run:
log delete --allTo remove all logs. Use sparingly-this affects forensic analysis.
When reporting issues to Apple Support, provide a log snippet with context. Include the timestamp, error message, and steps leading to the problem. This reduces resolution time.
For deeper analysis, export logs as JSON or CSV using the log command with --style json. Tools like Splunk or ELK stack can ingest these for enterprise monitoring.
Understanding system log macOS enables faster diagnosis of performance issues, security breaches, and software failures. It's not just for IT pros-it's essential for anyone who wants to maintain a stable, responsive Mac.