Log filtering is a crucial task for system administrators and developers who need to monitor, troubleshoot, and analyze system behavior. On macOS, there are several built-in tools that allow you to filter logs effectively. This article will guide you through the process of filtering logs using these tools.

Examples:

Using log Command

The log command is a powerful utility available in macOS for managing and querying the Unified Logging System. Here’s how you can filter logs using the log command.

Example 1: Basic Log Filtering

To filter logs for a specific process, you can use the log command with the predicate option. For instance, to filter logs for the kernel process, you can use:

log show --predicate 'process == "kernel"' --info

This command will display all logs related to the kernel process.

Example 2: Filtering by Subsystem

You can also filter logs by subsystem. For example, to filter logs for the com.apple.networking subsystem, use:

log show --predicate 'subsystem == "com.apple.networking"' --info

Example 3: Filtering by Date and Time

To filter logs within a specific time range, you can use the --start and --end options. For example, to filter logs from the last hour:

log show --predicate 'process == "kernel"' --start "$(date -v -1H +"%Y-%m-%d %H:%M:%S")"

Using Console App

The Console app in macOS provides a graphical interface for viewing and filtering logs.

1. Open the Console app from the Applications > Utilities folder.
2. Use the search bar at the top to filter logs by keywords, process names, or subsystems.
3. You can also create custom queries by clicking on the "Action" button and selecting "New System Log Query."

Using grep Command

For quick and simple log filtering, you can use the grep command in combination with log files.

Example 4: Filtering System Logs

To filter system logs for entries containing the keyword "error":

grep "error" /var/log/system.log

This command will display all lines in the system log that contain the word "error."

Example 5: Filtering Application Logs

To filter logs for a specific application, such as Safari:

grep "Safari" ~/Library/Logs/Safari.log

Automating Log Filtering with Scripts

You can automate log filtering by writing shell scripts. Here’s a simple example script that filters logs for a specific process and saves the output to a file:

#!/bin/bash

# Define the process to filter logs for
PROCESS_NAME="kernel"

# Define the output file
OUTPUT_FILE="filtered_logs.txt"

# Filter logs and save to the output file
log show --predicate "process == \"$PROCESS_NAME\"" --info > "$OUTPUT_FILE"

echo "Logs for process $PROCESS_NAME have been saved to $OUTPUT_FILE"

Save this script to a file, make it executable, and run it:

chmod +x filter_logs.sh
./filter_logs.sh