Download Caxton for Free · 7-day free trial of Caxton Pro, no credit card required · 7 MB · macOS 13.0+
The short answer
Console, in the Utilities folder of every Mac, shows the system's unified log with a search field, and Terminal reads any log file for free: log show for the unified log, tail -f to watch a file grow, and less to page through a large one. Caxton, a native Mac editor for text and data files, opens a log file of any size, tints error and warning lines, filters by severity, jumps to a time, follows a live file, and compares two logs side by side.
Where are log files stored on a Mac?
There are two kinds of log on a Mac, and they live in different places.
The unified log is the system's own record: messages from macOS and from every app that logs through Apple's logging system. It is not a file you open. It is a store that the Console app and the log command read for you, and Apple describes the categories it holds in Console's Reports sidebar: Crash Reports, with names ending in .ips, Spin Reports, Log Reports, Diagnostic Reports, Mac Analytics Data from /var/log/DiagnosticMessages, and the legacy system.log at /private/var/log/system.log.
Plain log files are ordinary text, one entry per line, written by apps, servers and scripts. On a Mac they sit in three folders. /var/log holds the system-wide files, including the install log and the legacy system log. /Library/Logs holds logs for apps and services installed for every user of the Mac. ~/Library/Logs, in your own home folder, is where most apps write their own files, and in Finder you reach it with Go ▸ Go to Folder and the path ~/Library/Logs. A server you run yourself, a build tool or a script usually names its own log file and folder in its documentation, and a log copied from a Linux server is just a text file wherever you saved it.
How do I view logs in the Console app?
Console comes with macOS. It is in the Utilities folder inside Applications, and Spotlight opens it by name. Apple's Console User Guide describes the first step: "in the Devices list on the left, select the device you want to view log messages for," then "Click Start in the toolbar. The log messages for the device appear in the window." Messages show as they occur, with a colored dot for each kind: red for faults, yellow for errors, dark gray for debug messages and light gray for informational ones.
To narrow the stream, Apple's guide says to "type a search phrase, then press Return." A search can target one property: "Click the arrow next to a search filter, then choose a property. For example, search within the process or the message," and a shortcut such as p:Spotlight searches by process name. Filters stack: "Place the pointer after the first filter, start typing search text, press Return, then change the search filter if desired. Repeat as needed." A search you will use again can be kept: "Click Save below the search field. Enter a name for the search. Click Save. The saved search appears in the Favorites bar."
The Reports section of the sidebar is where the plain files appear. Apple's guide describes Log Reports as "System and user reports with information about events that occur when the system or specific apps are processing," and they are the files from the folders above, opened in Console's viewer with the same search field.
How do I view log files in Terminal?
Terminal reads both kinds, and for the unified log it is the only way to ask precise questions.
The unified log with log show. Apple's manual page gives the first command: "View recent log messages: log show --last 1h." The --last value takes a number with a unit, "for example '--last 2m' or '--last 3h'." A predicate narrows it to a process, a subsystem or a message, in the format the manual page describes as "NSPredicate format or shorthand," with this documented example for a subsystem:
log show --last 1h
log show --last 30m --predicate 'process == "kernel"'
log show --predicate 'subsystem == "com.example.my_subsystem"'Live output with log stream. The same manual page lists "Stream live log messages: log stream." It takes the same --predicate option, and --style compact shortens each line.
log stream --predicate 'process == "kernel"' --style compactA log file with tail and tail -f. tail prints the end of a file, which is where the newest entries are. With -f, Apple's manual page says, it "causes tail to not stop when end of file is reached, but rather to wait for additional data to be appended," so the window keeps showing new lines as the program writes them. Press Control-C to stop.
tail -n 100 ~/Library/Logs/app.log
tail -f ~/Library/Logs/app.logA large file with less. less pages through a file of any size without loading all of it. Press the space bar for the next page, type a slash and a word to search, and press q to leave. Its F command does what tail -f does from inside the pager: the manual page describes it as "Scroll forward, and keep trying to read when the end of file is reached," which "is a way to monitor the tail of a file which is growing while it is being viewed." Starting with +F opens the file already following; Control-C returns to normal paging.
less /var/log/install.log
less +F ~/Library/Logs/app.logWhen does a log need more than Console or Terminal?
The free tools stop in a few predictable places. Console is built for the unified log and opens the report files one at a time; a single file of several gigabytes is not what it was made for. tail and less show text, but they do not know that a line is an error, cannot take you to 14:03 without scrolling, keep no notes, and cannot put two logs side by side. That is the point where Caxton, a native Mac editor for text and data files, fits.
1. Open the file, at any size
Drag the log onto Caxton or use File ▸ Open. A file recognized as a log, by its extension, by a file pattern rule or by the shape of its first lines, opens in Log Mode: error and warning lines carry a tinted row band, the minimap shows the same bands, and the filter bar gains a Severity popup. A file of 300 MB or more goes through the Open Large File dialog first, where Whole-File Virtual maps the whole file and indexes it in the background while you read. Opening, reading, searching and filtering are Caxton Free.
2. Filter by severity
Press ⇧⌘L for Filter Lines and choose Warn and above, Error and above, or Fatal only in the Severity popup, with any text condition on top. The severity comes from the line's own words in any case, or from a level field such as level=error in a key-value or JSON log, and a stack trace stays under its error line. The file is not changed; the filter is a view.
3. Go to a time
Press ⌥⌘L and type a clock time such as 14:03:30, a date and time, or an offset from the current line such as +5m. Caxton lands on the first line at or after that time and names it in a banner, reading the timestamps in the log's own zone when its lines carry one. Jump to a time in a log has the details.
4. Follow a live file
For a log that is still being written, choose Tail in the Open Large File dialog, which loads the last part of the file, and turn on Follow in the toolbar. Caxton checks the file for new bytes once a second and pins the view to its end as it grows, with search, filters and full scrollback still working. When a file grows faster than one check absorbs, the Following pill says how far behind it is; past half a gigabyte of backlog Caxton reloads the last 64 MB and names the byte range it skipped, which View ▸ Log ▸ Catch Up to Live does on demand and Open Skipped Range as Slice brings back. When the file is rotated, the follower finishes the old file, shows a prompt naming any unread bytes, and starts on the new one. A smaller log opened whole is watched too, and reloads when it changes on disk.
5. Keep notes and compare
Bookmark the lines that matter and add a note to each; the Bookmarks panel lists them with their time and severity, and Copy as Incident Notes puts the table on the clipboard for a ticket. File ▸ Compare With… opens a second log beside the first, scrolled as one, with the differences marked. Both are Caxton Free. Extracting the lines around every bookmark to a new document, Extract Incident Window, writes a new file and is Caxton Pro, which every download includes as a 7-day free trial with no credit card required.
Which approach fits which job?
| Job | Use | Cost |
|---|---|---|
| See what macOS or an app logged in the last hour | Console, or log show --last 1h | Free, built in |
| Watch system messages as they happen | Console with Start, or log stream | Free, built in |
| Read the end of a log file | tail -n 100 | Free, built in |
| Watch a log file grow | tail -f, less +F, or Caxton's Follow | Free |
| Page through a multi-gigabyte file | less, or Caxton | Free |
| Only the errors, or the lines at 14:03 | Caxton: Severity filter and Go to Time | Caxton Free |
| Notes on what you found, two logs side by side | Caxton: Bookmarks and Compare With | Caxton Free |
| The lines around every bookmark as a new file | Caxton: Extract Incident Window | Caxton Pro |
For the larger files, open a 10 GB log file and filter large log files continue from here, and choosing a log viewer weighs the dedicated tools against each other.
Open the log, filter to Error and above, and jump to the minute it happened.
Download Caxton for Free7-day free trial of Caxton Pro, every feature, no credit card required. After it, Caxton Free keeps opening, searching and filtering at any size.
Frequently asked questions
Where are log files stored on a Mac?
The system's unified log is a store read by the Console app and the log command rather than a file. Plain log files live in three folders: /var/log for system-wide files, /Library/Logs for apps and services installed for every user, and ~/Library/Logs in your home folder, where most apps write their own files. Console's Reports section lists the same files, and a server or script usually documents its own log location.
How do I view system logs in Terminal?
log show --last 1h prints the last hour of the unified log, the --last value takes a number with a unit such as 2m or 3h, and --predicate narrows it, for example --predicate 'process == "kernel"'. For a plain file, tail -n 100 prints the newest entries and less pages through a file of any size.
How do I watch a log file as it updates?
tail -f file.log keeps printing new lines as they are written, and less +F does the same inside the pager, with Control-C to stop. For the unified log, log stream prints messages as they occur. In Caxton, open a file of 300 MB or more as Tail and turn on Follow in the toolbar: the view pins to the end as the file grows, the pill says how far behind it is, and a rotated file is followed to its replacement.
Can I view logs from another Mac or a server?
Console shows the unified log of the Mac it runs on and of Apple devices connected to it; it does not read a Linux server's logs. Copy the server's log file over, with scp or by downloading it, and read it like any other text file: less and tail in Terminal, or Caxton, which opens a copied log of any size with the severity filter and Go to Time working on it.
Sources
- Apple Support: View log messages in Console on Mac
- Apple Support: Find log messages and activities in Console on Mac
- Apple Support: View reports in Console on Mac
- Apple's manual pages on macOS:
man log,man tailandman less, read with the shipped tools in Terminal - Caxton manual: Log Mode, Go to Time, the severity filter and following
- Caxton manual: Opening large files, the Open Large File dialog and Tail mode