View system logs on macOS

On modern macOS, start with Unified Logging. Many system and application events never appear in /var/log/system.log. The log command queries the unified log store, while Console provides a graphical view.

The traditional file remains useful when the event you need is written there. /var/log normally resolves through /private/var/log; these are not separate old and new logging systems.

Check traditional text logs

sudo tail -F /var/log/system.log
sudo less /var/log/system.log
sudo grep -i 'error' /var/log/system.log

Use these commands only if the file exists. tail -F follows the filename across common rotation operations, and less is more practical than printing a large file in full.

Query unified logs

# Recent history.
/usr/bin/log show --last 1h

# Include informational and debug events that are available in the store.
/usr/bin/log show --last 10m --info --debug

# Stream live events.
/usr/bin/log stream

# Narrow the process and time range.
/usr/bin/log show --process kernel --last 30m

The absolute path avoids shells that use log for another command. --info and --debug affect which available records are displayed; they do not retroactively persist messages the system never retained.

Check /usr/bin/log help predicates for the fields supported by your macOS version. For example, current versions exposing logType accept:

/usr/bin/log show --last 1h \
  --predicate 'logType == "error" OR logType == "fault"'

Older versions document messageType for this purpose. Use the locally documented field names and quote string values. Filter by process, subsystem, and a short time window before widening the search. Some fields remain private or redacted; elevated permissions do not guarantee that every value was retained in readable form.

Use Console and crash reports appropriately

Open Console from Applications → Utilities, select the relevant device, and start viewing its log messages. Search and filter by the problem's process or time range rather than treating the view as a complete history of every event. Apple's Console guide explains the available views.

Crash and diagnostic reports are a separate source. Common locations include ~/Library/Logs/DiagnosticReports/ for user reports and /Library/Logs/DiagnosticReports/ for system reports; availability depends on how the failure was recorded.

If a record is absent from system.log, query Unified Logging next. If it is absent there too, consider retention, logging level, privacy, and whether the application writes its own file. A missing text-file entry alone does not establish that logging failed.