One of the top troubleshooting tools you will use in OS X is the Console app, with which you can view a centralized list of logged system activity, be it from the system console or from application-specific log files. With the details output in the resources available in the Console, you can often track relevant activity for when crashes and other faults occur, and then address them accordingly.

The Console is generally more useful for power users, though by poking around you can also get a general gist of what may be happening in real-time on your Mac; however, experience will tell you that most of the details you see in the Terminal are unimportant, and more often than not you will need to filter messages to find relevant information.

Even though it is ultimately a list of messages, the Console does have a few options that can help you sift through its output and find what you need.

View options

The default view of the console shows a fairly bland list of logged events; however, you can enhance this by enabling a few options. Go to the View menu, under which you will see four options:

1. Show the sender icon — If a user app is experiencing problems, enabling this will have its icon show in-line with the console message and help you identify it. System services comprise the majority of console messages, and these have no icons so they will appear as an empty box.
2. Show the sender in bold — This will help you identify the process identifier from the rest of the console message.
3. Show the process ID (PID) — This is particularly useful for identifying the process for use in another app, such as targeting it with Terminal commands or seeing it in Activity Monitor. Often several instances of a process will be running simultaneously, and may be difficult to distinguish in the console without the PID enabled.
4. Show milliseconds — Every now and then you may need to track the succession of processes that occur rapidly. While all events in the console will appear chronologically, this may help you determine exact lengths of time between events.

Inspector

The console will output a message’s timestamp, name, PID, and message, which is most of what you will need; however, messages also contain message ID numbers, user and group IDs, message levels, host information, and more. These may have more nuance uses, but can be seen by selecting a message and pressing Command-i or clicking the inspector button in the toolbar.

Sender statistics

While the console is useful for viewing ongoing activity, you may want to see what processes are causing the most activity. In the console, processes that send messages are called “senders” and you can see a list of senders by clicking the small icon at the lower-left of the console window. In the panel that pops up, you will see the top 10 senders, but you can set this to 5, 10, 15, 20, 25, or “all” senders in the Console preferences.

With this feature, you can check the box next to particular senders to isolate messages from them, and better track their activity. This can be used in conjunction with searches for message content, but can be used separately as well. By default items in the sender statistics list will be unchecked, and checking all may be cumbersome; however, you can select one item, then option-click that same item. This will invert the selection, including all but the current item which you can simply click again to include. Now you have all items selected, and can exclude some easily by unchecking them.

Multiple windows

A final tip when using the console is to expand the view to multiple windows. Often you may need to run different searches in the console to view the activity of interest, but in doing so you may include too many criteria on one window to easily track. By opening a second window (choose New Log Window from the File menu), you can do one search query in the first window, and a second query in the second window, then align these two side-by-side and watch the message output populate between them in real-time.