What is Console on Mac & How to Read Mac Console Logs (2022)

Summary: This post tells you the basics of the macOS Console app, including what Console is, how to access or close it, and how to check Console on Mac to figure out the reason for a crash.

Did you notice a macOS app called Console with the black and yellow screen reading "Warning AY 7:36" on your Mac Dock or the Utilities folder? At first look, the icon may worry some, but it's actually a less known but helpful application for identifying what makes Mac keep crashing.

Some may even find the Console app running on Mac by itself, which is often a result of enabling the "Open the scan log automatically" feature on third-party anti-virus programs like ClamXAV.

Here, we will discuss what Console is used for and how to use Console on Mac to troubleshoot crashes.

What is Console on Mac?

The macOS Console app provides crash reports and Live log messages of the running processes on your Mac & its connected devices generated by the operating system and applications to help you find the source of a problem or check your Mac's performance.

For instance, if an app crashes frequently, you can view the log files created by the app to figure out what task it is performing before the crash. If you see a pattern, you know it's this specific task causing the trouble.

Note: It's normal to see many Mac Console errors and faults during regular use of your Mac. There's no need to worry about these log messages unless you are having issues with a particular app.

How to access Mac Console?

How to open Console on Mac:

Access from the Applications folder: Click Finder > Applications > Utilities, then double-click Console.
Open from Launchpad: Click Launchpad > Other > Console.
Use Spotlight search: Press Command + Space to call up Spotlight, then type in Console.

How to close Console on Mac:

If the Console app works correctly, you can press Command + Q or click the × icon to close it.
To get rid of Console from the Dock, right-click on its icon, then choose Options > Remove from Dock.

What does console do on Mac?

Although the log files on Mac are meant for developers to understand macOS better, you probably know enough to determine whether a particular process is stalling your Mac. Once you access the Console app on macOS Monterey, you will notice the Start streaming button.

If you click on it, the number of messages sent out by the processes and services running on your Mac will rise quickly. You can choose to view All Messages or only Errors and Faults.

Note: Macs running macOS 10.15 Catalina or earlier may open to a whirlwind of messages running automatically.

If you click the Now button at the top toolbar, it will automatically scroll down the message window while new ones come in to assist you in debugging an issue in real-time. You can stop the messages piling up by clicking the Pause button. These log messages are categorized with a colored dot.

Yellow dots: Errors
Red dot: Faults
Dark gray dots: Debug log messages
Light grey dots: Info log messages
No dots: Default

Move to the left sidebar, and you will find your Mac and other Apple devices using your Wi-Fi network, along with the following reports:

Crash Reports: System and user reports generated by the background process ReportCrash regarding crashed apps or processes (named with the .ips extension). If an app crashes often, you can send these crash reports to the developer to find a solution.

Spin Reports: System and user reports detailing app or process issues (named with the .spin extension).

Log Reports: System and user reports showing events that occur when the system or specific apps are processing (named with an extension such as .log, ._log, or .its).

Diagnostic Reports: System and user reports presenting information about hardware resources, system response times, and more (named with an extension such as .diag or .dpsub).

Mac Analytics Data: Details of the Message Tracer Store data at /var/log/DiagnosticMessages.

system.log: Details of the legacy Mac system log file found at /private/var/log/system.log.

How to read Mac Console logs?

The most challenging part of fixing a Mac error is finding the cause. Luckily, macOS Console records everything your Mac does in a manageable way. Here, you will learn how to check Console for error messages on Mac.

Note: You need to Enable Root User to view the contents in system.log.

How to Enable Root User on Mac:

Click the Apple menu > System Preferences > Users & Groups.
Click the lock icon and enter your administrator's name and password.
If you have logged in to the admin account already, you will see the word "Admin" under your user name.
Click Login Options.
Click Join.
Tap on Open Directory Utility.
Click the lock icon and enter your password again.
Click the Edit menu on the top menu bar and tick Enable Root User.

You can now check the logs in system.log. And remember to follow the same process to Disable Root User after finishing the task.

Find log messages of the troublemaking app

A console message consists of a timestamp, the app or process, and the log details. You can follow these steps to locate the error messages of an app on macOS Monterey or Big Sur. Other macOS versions may have slight differences but follow the overall process.

Open macOS Console.
Click the Action tab on the top menu bar.
Select "Include Info Messages" and "Include Debug Messages."
Select your Mac or a connected device that you want to investigate from the left sidebar.
Type the app name into the search field and press Enter.
Refine the search if needed.
If you want to narrow down the results further, click the arrow next to Any to choose a property. If an app like Mail keeps crashing, you can click the Save button to keep your query about the Mail app for monitoring.
Select a log message, right-click on it, and choose Hide Type' default' to exclude regular logs.
Click on an error message to view the details.

Now, look for error codes or repeated blocks of log materials, which are most likely the culprit. Then search the Mac Console errors and faults in Google to find a solution.

Understand Crash Reports in macOS Console

If you click the Crash Reports tab, you will find the full report of crashed apps and processes on your Mac. Here is an example of how to read Mac Console logs.

This is a crash report of Microsoft Word on Mac. We can get the following information based on the contents:

Crashed app: Microsoft Word
Crashed process: Microsoft Word [878]
Time of crash: 2022/3/22 5:49 p.m.
Running macOS: macOS 12.2.1
Crash Details: The exception type is EXC_BAD_INSTRUCTION, caused by the thread performing an illegal instruction.
What lead to the crash: Thread 0 crashed and the “libsystem_secinit.dylib 0x7ff81f5f83da _libsecinit_appsandbox.cold.6 + 49” is the reason for the crash.

The first column shows the frame number, such as 0, 1, 2….

The second column is the task name the app is executing. For instance, libsystem_secinit.dylib.

The third column tells the counter program address.

The fourth column is the task itself.

Apple explains more details in this guide about the fields of a crash report.

Here are some common exception types and their meanings:

EXC_BAD_ACCESS/KERN_INVALID_ADDRESS: The thread tried to access unmapped memory, triggered by data access or instruction fetch.
EXC_BAD_ACCESS/KERN_PROTECTION_FAILURE: The thread attempted to write to read-only memory, often caused by data access.
EXC_BREAKPOINT (SIGTRAP)/EXC_BAD_INSTRUCTION(SIGILL): The thread executed an illegal instruction.
EXC_CRASH (SIGKLL): The Mac operating system terminated the process.

Share the logs, activities, or reports with experts

Some app or process names are easy to comprehend, such as "ReportCrash" for macOS's crash reporter and "backupd" for Time Machine. But some are less understandable, such as "mdworker" for the Spotlight process.

That's why you may need to share the log message with someone who can help you troubleshoot the problem. Here are the ways to share log messages to app developers or an expert:

Use the Share icon at the top toolbar.
Right-click on an error message, choose Reveal in Finder, then send the file to others.

Mac Console shortcuts

Here is a list of keyboard shortcuts you can use to accomplish many tasks quickly:

Tasks	Mac Console Shortcuts
Search for log messages/activities	Option-Command-F
Reload log messages/activities	Shift-Command-R
Clear log messages/activities	Command-K
Locate text in log messages	Command-F
Move to the latest log messages/activities	Shift-Command-N
Reveal a report in Finder	Command-R
Copy selected text	Command-C
Enter or Exit fullscreen	Control-Command-F
Show or hide the sidebar	Control-Command-S

How to Use macOS Console to Read Console Logs?