Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I am trying to debug a crashed (or hanging) app. How do I get the diagnostic files from the crash?

share|improve this question
add comment

2 Answers

Apple sysdiagnose

This shell script(on 10.8 and lower) and executable program by the same name on 10.9:

  • gathers system-wide diagnostic information
  • is integral to OS X Lion and greater
  • is not available as a separate download
  • is not open source (I have asked Apple to make it so).

Preparing for the keyboard-only approach to sysdiagnose

In Terminal, run the following command.

sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.stackshot.plist
  • if prompted for a password, enter your admin password for the operating system
  • that's a one-off, no need to repeat the command.

Take a written note of the following key chord, you'll need it later:

Control-Option-Command-Shift-.

Diagnosis by the system

When an issue occurs:

  1. use the key chord
  2. for at least ten seconds, touch nothing
  3. allow maybe five or ten minutes for all parts of the sysdiagnose routine to complete – simply wait as long as you can (there'll be no on-screen indication of progress)
  4. Finder should open a window to the end result.

Exceptionally

In rare cases, an issue may prevent sysdiagnose from completing (I have made improvement suggestions to Apple). If this happens – if you're sure that you have waited long enough – it may be sensible to restart the Mac. Then:

  1. in Finder, go to /private/var/tmp
  2. seek a file or folder with a name beginning sysdiagnose_
  3. if that file or folder exists, move it to a convenient place – your desktop, maybe.

Hints

Without the key chord, you can run sysdiagnose from the command line (see below, Apple manual page). But it's often more useful, or necessary, to use the chord – so be prepared.

Whilst I don't encourage carelessness, you can be a little careless with Control-Option-Command-Shift-. … if you struggle to avoid the fn key on your laptop, don't worry; including it by accident should not prevent the run of sysdiagnose.


Human analysis of diagnosis by the system

Hint: someone might like to ask a separate question about analysing the results of sysdiagnose – a more generalised answer could be useful.

If sysdiagnose_… from the /tmp area is a file

Presence of a sysdiagnose_….tar.gz file indicates that all parts of the sysdiagnose routine completed, and that the results were archived. If you wish, open the archive – its contents will appear as a folder.

If sysdiagnose_… from the /tmp area is a folder

Presence of a sysdiagnose_… folder (not a .tar.gz file) indicates that either:

  • the routine was interrupted before completion; or
  • some part of the routine could not complete.

Within the archive/folder

Some files are human-readable and may help to troubleshoot an issue.

Other files are more developer-oriented.

Related:

For an incomplete run of sysdiagnose it may be useful to focus some attention on files that are abnormally empty …


Technical and other notes

stackshot(1) OS X Manual Page

sysdiagnose(1) OS X Manual Page

Some of what's above is a more generic edition of an accepted answer that appears elsewhere.


Diagnostic and usage information, other files of interest

Be guided by the log list in Console:

A screenshot of the sidebar of Console

Expect to find files at the following paths:

  • ~/Library/Logs/DiagnosticReports
  • /Library/Logs/DiagnosticReports
  • ~/Library/Logs
  • /Library/Logs
  • /private/var/log
share|improve this answer
    
excellent answer, thank you very much!! –  Martin Apr 17 '13 at 22:48
1  
→ Graham: this is a + day: something to learn! I think this kind of tool would benefit all sysadmins input if it was open source. –  daniel Azuelos Aug 4 '13 at 13:42
add comment

Individual crash reports are stored in ~/Library/Logs/CrashReporter but there is a system wide log collection tool called sysdiagnose.

Once you start experiencing the issue, hold down the 4 control keys and then press the period "." key. shift+control+option+command+.

After about 15 seconds, a Finder window will open with a sysdiagnose file highlighted.

Once you start experiencing the issue, hold down the "shift"+"control"+"option"+"command" keys and then press the period "." key.

This shortcut simply executes the sysdiagnose command, so if you are familiar with the terminal and want to pass in a process ID, you can get enhanced debugging information about that specific program. The key shortcut calls the tool with no arguments and captures the basic report only.

share|improve this answer
    
is there a way, to get this by command line? –  Sidasa Aug 7 '12 at 21:42
    
~/Library/Logs/CrashReporter does not contain .crash files. Instead: /Library/Logs/DiagnosticReports and ~/Library/Logs/DiagnosticReports –  Graham Perrin Feb 14 '13 at 19:31
    
The key chord for sysdiagnose will work only if the stackshot daemon runs. In my answer, the launchctl command will start the daemon. –  Graham Perrin Apr 6 '13 at 17:16
    
is the sysdiagnose command also available in OS 10.6? I don't find a man page and which sysdiagnose returns nothing in OS 10.6.8, or do I have to install it explicitely? –  Martin Apr 17 '13 at 22:56
1  
@Martin my answer is edited to address your question. –  Graham Perrin Jun 17 '13 at 11:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.