Console.app: A Mac Admin's Guide to the macOS Log Viewer

Why Console.app Still Matters

Many Mac admins live in the terminal, and the log command is undeniably powerful. But Console.app has a few advantages that earn it a permanent place in the toolkit:

• Visual scanning of large log volumes with color-coded message types
• One-click remote device connection for iOS devices and other Macs
• Crash report and diagnostic report browsing with structured display
• Saved search filters that persist across sessions
• No predicate syntax to memorize for quick ad-hoc investigations

Console.app is located at /System/Applications/Utilities/Console.app, or launch it with Spotlight (Cmd + Space, type “Console”).

Interface Overview

Console.app’s interface is divided into several areas:

Sidebar (Left Panel)

The sidebar shows available log sources:

• Your Mac: Streams or searches logs from the local machine
• Devices: Any connected iOS/iPadOS devices or simulators appear here
• Log Reports: Saved .logarchive files you have opened
• Crash Reports / Diagnostic Reports: Located under the system and user report folders

To connect a remote Mac, the target must have Remote Login enabled (System Settings > General > Sharing > Remote Login). Then in Console.app, choose File > Connect to Remote Log Source and enter the hostname or IP address.

Message List (Center)

The main area displays log messages in a scrolling table. Each row shows:

• Timestamp: When the message was generated
• Type indicator: Color-coded dot (gray = Default, blue = Info, green = Debug, yellow = Error, red = Fault)
• Process: The process that emitted the message
• Message: The log message text

Click any message to see full details in the Info panel.

Search Bar (Top)

The search bar supports text search across all visible fields. It also allows you to build compound filters.

Info Panel (Bottom)

Select any log message to reveal detailed metadata: subsystem, category, process ID, thread ID, the full message text, sender library path, and more. This is where you find the subsystem and category identifiers needed for terminal predicates.

Pro tip: When you spot an interesting message in Console.app, look at its subsystem and category in the Info panel. Then use those values to build a precise log show or log stream predicate in the terminal.

Filtering and Searching

Quick Text Search

Type any text in the search bar to filter visible messages. Console.app searches across process names, message text, and subsystem identifiers.

Building Compound Filters

Click the search field, and Console.app presents structured filter options:

1. Library: Filter by the framework or library that generated the message
2. Subsystem: Filter by subsystem identifier
3. Category: Filter by category within a subsystem
4. Process: Filter by process name
5. PID: Filter by specific process ID
6. Type: Filter by message type (Default, Info, Debug, Error, Fault)
7. Message: Free-text filter on message content

You can stack multiple filters. For example: Process = mdmclient AND Type = Error shows only MDM error messages.

Including and Excluding Messages

After typing a search term, click the dropdown arrow next to it and choose:

• Include: Only show messages matching this filter
• Exclude: Hide messages matching this filter

Exclusion is particularly useful for suppressing noisy subsystems that clutter the view while you hunt for relevant data.

Toggling Info and Debug Messages

By default, Console.app shows only Default, Error, and Fault messages. To see more detail:

• Action menu > Include Info Messages: Shows Info-level messages
• Action menu > Include Debug Messages: Shows Debug-level messages

These map directly to the --level info and --level debug flags in log stream.

Saving Searches

Once you have built a useful filter combination, save it for reuse:

1. Configure your search filters in the search bar
2. Go to File > Save Search (or click the Save button near the search bar)
3. Name the search and it appears in the sidebar under Searches

Recommended saved searches for Mac admins:

• MDM Errors: Subsystem = com.apple.mdmclient, Type = Error
• Software Update: Process = softwareupdated, Include Info Messages
• Wi-Fi Issues: Subsystem = com.apple.WiFiManager
• Login Events: Subsystem = com.apple.loginwindow
• Kernel Faults: Process = kernel, Type = Fault

Connecting to iOS Devices

Connect an iPhone or iPad via USB cable. The device appears in the Console.app sidebar under Devices. Click it to stream logs from the device in real time.

This is invaluable for diagnosing:

• MDM enrollment issues on supervised iOS devices
• Managed app installation failures
• VPN and network extension problems
• Push notification delivery issues

Note: The connected device must be unlocked and trust the Mac. If the device does not appear, check the USB connection, unlock the device, and confirm the trust dialog.

Reading Crash Reports and Diagnostic Reports

Console.app provides a structured view of crash and diagnostic reports stored in:

• User Reports: ~/Library/Logs/DiagnosticReports/
• System Reports: /Library/Logs/DiagnosticReports/

In the sidebar, expand Crash Reports to browse them. Each report shows:

• The crashed process name and path
• Exception type and signal
• The crashed thread’s backtrace
• Binary images loaded at the time of crash

For Mac admins, crash reports are essential when diagnosing application compatibility issues, extension crashes, or kernel panics. Look for the Exception Type and Termination Reason fields first to understand the class of failure.

System Diagnostics

Console.app can trigger a sysdiagnose collection:

1. Go to File > System Diagnostics (or press Ctrl + Option + Cmd + Shift + .)
2. macOS collects a comprehensive diagnostic bundle including logs, system state, and performance data
3. The archive is saved to /var/tmp/ and opened in Finder

This is the same data collected by sudo sysdiagnose in the terminal but triggered through the GUI.

When to Use Console.app vs. Terminal

The practical workflow for most Mac admins is: start in Console.app to visually locate the relevant messages, note the subsystem and category from the Info panel, then switch to the terminal with log show or log stream for precise, repeatable, scriptable queries.

Console.app is not a replacement for command-line log analysis. It is the visual companion that makes the command-line tools easier to use effectively.