1

I want to learn how to debug kernel crashes and am not at all familiar with macOS logging. Specifically the logs files that might reveal a system crash for example due to kernel panics.

Does Apple document this or do I need third party book or training?

1
  • Now it seems like 3 questions to me instead of 2. the goal of editing is to make it read as one coherent ask. Please change my edit if I didn’t guess the one question you have. Just realize the community will likely vote to close questions that don’t show research (you didn’t show any here) or have multiple parts. – bmike Jun 10 '20 at 16:35
2

The easiest thing to do is to bring up Console, then for each log you are interested in, simply right-click and choose 'Reveal in Finder'. Your logs may vary. (If you don't know where Console is, simply search for it in Spotlight.)

screen grab of Mac Console

Apple has a unified log system now, so you don’t want to just look at files like traditional unix logging. The log stats command will parse all available logs and let you know the current volume of information, how long it lives before being discarded, what severity of messages are so you can craft log show commands to dump specific entries of interest. Major events like a kernel panic do drop structured text files with details, but the logs are the best source.

For an intro to kernel debugging Apple does a great job. You can get Xcode for free and it has Instruments so you can inspect the system as it runs and also develop a kernel extension if you need to cause crashes or really get to low level.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .