Ask Different is a question and answer site for power users of Apple hardware and software. It only takes a minute to sign up.
Sign up to join this community
I want to learn how to debug kernel crashes and am not at all familiar with macOS logging. Specifically the logs files that might reveal a system crash for example due to kernel panics.
Does Apple document this or do I need third party book or training?
The easiest thing to do is to bring up Console, then for each log you are interested in, simply right-click and choose 'Reveal in Finder'. Your logs may vary. (If you don't know where Console is, simply search for it in Spotlight.)
Apple has a unified log system now, so you don’t want to just look at files like traditional unix logging. The log stats command will parse all available logs and let you know the current volume of information, how long it lives before being discarded, what severity of messages are so you can craft log show commands to dump specific entries of interest. Major events like a kernel panic do drop structured text files with details, but the logs are the best source.
For an intro to kernel debugging Apple does a great job. You can get Xcode for free and it has Instruments so you can inspect the system as it runs and also develop a kernel extension if you need to cause crashes or really get to low level.
