Way back in the good old days it was pretty straightforward to go and do some amateur spelunking in the depths of your Mac. Breaking important and vital things in the operating system was a – well, not trivial undertaking, but certainly a relatively simple one. Fortunately it was also very easy to go poking around in the Console.app to see what your Mac was up to so that you had at least a reasonable chance at deciding what you’d done wrong so that you could fix it.
And then, of course, Apple had to go and make it all better. Okay, the “better” there is a hair subjective, so I’ll clarify: Apple introduced a new, unified logging system whereby error logs were dynamically and intelligently supported as a matter of course, allowing you greater flexibility in being very granular in digging through logs as well as making the log files a lot smaller. Which was nice.
What wasn’t so nice is that it’s now terribly awkward to search through system logs. Sure, you can fire up the Console and watch error messages scroll by – and scroll back to look at them for the current session – but looking back through logs is a trifle more problematic, and requires a little command-fu.
Enter the log command, which allow you to (amongst other things) search through your log files to pull out user-defined strings, thus:
log show --predicate 'eventMessage contains "Previous shutdown cause"' --last 24h