I spent the better part of the last two days trying to figure out why I was seeing random / missing / corrupt log messages when trying to log from a kext on macOS Sierra. Sometimes the message was in the Console. Sometimes not. If I built a new copy of my kext and unloaded/reloaded, then the Console would just show random gibberish when logging.

The result of my suffering is that this specific combination works reliably:

#include < os/log.h >
* … *
os_log(OS_LOG_DEFAULT, “Your message with optional modifiers.\n”);

Then, from terminal:

log show –predicate ‘senderImagePath CONTAINS “MyKextName”’

(MyKextName is $(ProductName) in Xcode. not a com.whatever.thing. It is also case sensitive) That log command will show only Default messages and Fault messages. If you want to see Debug messages from ` os_log_debug( .. ) ` or Info messages from ` os_log_info( .. ) ` then include –debug and –info. But, these two types are not reliable in my experience.. Sometimes they log successfully, sometimes they don’t. I don’t see that issue with Default & Fault types.

Okay, so why log show, and not the Console.app or log stream? In particular, log stream cannot be used. stream cannot open the kernel process ID 0 for some reason. (I have SIP off, have sudo’d, and am running a development kernel, too), log stream will print some kernel messages, namely those generated by the OS itself. But stream will not show messages sent by my kext, at least. You can see some kind of error occur if you try to use ` log stream —process 0 ` or ` log stream —process kernel ` . Both error “PID not found for 0|kernel”.

I highly recommend playing around with Consolation if you have any trouble with the predicates - https://eclecticlight.co/tag/consolation/ .

Things I still don’t understand:

Possibly helpful links to learn more about the system:


Last, for anyone searching…:

log stream
log show
Unified Logging
Activity Tracing
.plist missing kernel logs missing kext logs logs corrupt Console gibberish os x Sierra radar bug report 28948441 sysctl debug.kextlog debug.oslog