Where Mac OS Stores System Logs
macOS writes system logs into a structured hierarchy under /var/log and /Library/Logs, with user-level logs tied to each account. The unified logging system introduced in recent versions of macOS moves much of this into a binary store accessed through the log command, which means older text-file paths still exist but are not always the primary source of truth. Apple maintains these logs in rotated, compressed archives, and the system purges older entries based on space and policy.
More from this site
Keep reading the latest coverage
The key directories to know are /var/log for system-wide services and /Library/Logs for per-machine software output. User-specific logs sit in ~/Library/Logs, where individual apps write their own diagnostic files. For immediate troubleshooting, the Console app provides a graphical front-end to this entire stack, including both traditional text logs and the newer unified logging messages.
Using the Console App for Everyday Debugging
Console.app is the most direct way most users and administrators interact with Mac OS system logs. It lets you search by subsystem, category, sender, or process ID, and it can pin frequently used queries. You can filter by log level — debug, info, error, fault — and by time range, which is useful when you are trying to isolate a crash or a sudden kernel panic.
Because the unified logging system compresses and samples high-volume messages, not every event will appear in Console at full fidelity. You can use the Include Debug Messages option to increase verbosity, but that significantly increases disk I/O and should be turned off when you are done. The app also surfaces crash reports and diagnostic logs from third-party software, which often point to the exact line of code that failed.
Reading Raw Logs from the Command Line
For deeper inspection, the log command provides access to the unified logging store from Terminal. You can stream live entries with log stream, or pull a bounded history with log show, specifying predicates, style, and time ranges. This approach is faster than opening Console for large datasets and integrates cleanly with shell scripts, grep, and other Unix tools.
Common predicates include subsystem, category, sender, and process. For example, filtering by a specific daemon lets you isolate network or storage issues without wading through unrelated messages. Output can be formatted as compact, json, or csv, which makes it straightforward to pipe results into analysis tools or save them for later review.
Key Log Types and What They Tell You
| Log Type | Typical Location | What It Reveals |
|---|---|---|
| System Log | /var/log/system.log | Kernel, launchd, and core system events |
| Crash Reports | /Library/Logs/DiagnosticReports/ | Stack traces for crashed apps and daemons |
| Network Activity | /var/log/NetworkStatistics | Interface stats, packet counts, and errors |
| Boot Log | log show --predicate 'eventMessage contains Boot' | Kernel boot timeline and initialization phases |
| User App Logs | ~/Library/Logs/ | Per-user application diagnostics and errors |
When to Clear or Rotate Logs
Mac OS system logs can grow large over time, especially on machines that run for months without reboot or that host high-volume services. The system handles most rotation automatically, but you may want to free space or reset logs before capturing a fresh diagnostic snapshot. Clearing logs should be done carefully; deleting files in /var/log while services are writing to them can cause issues.
The safest approach is to use log collect to gather a time-bound bundle and then let the system manage the underlying store. Third-party tools can also rotate and archive logs, but they should be tested before deployment on production machines. Always keep a recent backup of logs if you suspect a transient fault that may recur.
Limitations of the Unified Logging System
The unified logging system improves performance and privacy by default, but it also means some log entries are discarded quickly or stored in a compressed format that is not easily searchable with traditional text tools. If you need long-term retention or highly specific query patterns, you may need to configure a custom logging profile or use a third-party log shipper. Understanding these trade-offs helps you choose the right method for capturing the evidence you need without overwhelming disk or CPU.