Search the Unified Log with log show

Filter macOS's single unified log by process, message type, or subsystem straight from the Terminal.

macOSlogtroubleshootingloggingDiagnosticsLow risk

Run `log show --last 1h --predicate 'process == "loginwindow"'` to dump that process's log entries from the past hour.

01Command

Command

$ log show --last 1h --predicate 'process == "kernel" AND messageType == 16' --style compact

02What it does

macOS replaced flat text logs with a binary unified store, so grep on /var/log finds almost nothing anymore. The --predicate language accepts process, sender, subsystem, eventMessage, and messageType (16 = error, 17 = fault). `log stream --predicate ...` is the live follow mode, and --style compact keeps output readable.

03Risk

RiskLow risk

RequirementsPredicate queries on some private data require sudo.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

macOS log — show the unified logging system data
SS64 · technical · 2026-09-17
Evidence: Documents log show, --last, --predicate and --style options for the unified log.

Last verified: 2026-09-17 · Category: System & Settings

06Related solutions

Rebuild the Spotlight index on Mac

macOSTerminalDiagnostics

Erase the broken Spotlight database so macOS re-indexes your drive from scratch.

Medium risk ✓ 2026-09-16

Find your Mac's serial number from the Terminal

macOSDiagnostics

Read the serial number, model identifier and chip without opening About This Mac.

Low risk ✓ 2026-09-16

Check your MacBook's battery cycle count

macOSPower & SleepDiagnostics

See how many charge cycles the battery has used and its health condition.

Low risk ✓ 2026-09-16