Where apps hide your files

Mac log folders, mapped

Updated 2026-10-28 · 6 min read

A Mac's logs are spread over three readable folders and one binary database. You will learn which holds what, how to read the unified log with log show or Console, and what you should never delete.

The locations

/var/log                        system and service log files
/Library/Logs                   logs from software installed for all users
~/Library/Logs                  logs from apps you run
/var/db/diagnostics             the unified log store (binary)

Those four places hold nearly everything. /var/log is the same folder as /private/var/log. In Finder, press ⇧⌘G and paste a path to open it, or use open /var/log in Terminal. For your own folder, ~/Library/Logs works the same way.

The surprise is the fourth line. Since macOS Sierra (10.12), Apple's own components write to a binary store called the unified log, so a plain-text file you can open is the exception. On the Mac used for this guide, /var/log/system.log was only 7.7 KB, while /var/db/diagnostics was 1.8 GB. The text files in /var/log are mostly what third parties and a few system services still write.

What each folder holds

Folder	Typical contents on the guide Mac
/var/log	install.log, wifi.log (with older .bz2 copies), fsck_apfs.log, system.log and its .gz copies, a powermanagement folder of daily .asl files, plus logs from services such as VPN agents
/Library/Logs	DiagnosticReports, CrashReporter, Adobe logs, helper-tool logs from installed apps
~/Library/Logs	One folder or file per app (Adobe, Homebrew, JetBrains, Claude, CoreSimulator and others), plus DiagnosticReports for your crashes
/var/db/diagnostics	Persist, Special, Signpost and HighVolume folders of .tracev3 files, plus timesync
/var/db/uuidtext	Lookup data that turns the binary entries into readable text

Not everything here is open to every account. system.log belongs to root with group admin and no access for anyone else, and /var/db/diagnostics is restricted the same way, so an administrator account can read them and a standard account cannot. "Permission denied" means the file is protected, not broken. Full Disk Access for Terminal does not change these Unix permissions.

Reading the unified log

The .tracev3 files are a compressed binary format. Do not open them in a text editor. Use the supported tools:

log show --last 30m
log show --last 1h --predicate 'process == "Finder"'
log stream --level info

The first prints the last half hour. The second filters by process name. The third follows new entries live. The volume is huge: one minute of history ran to about 100,000 lines on the guide Mac, so always give log show a time range or a predicate.

To keep a copy for support or for later, run:

sudo log collect --last 1h --output ~/Desktop/mac.logarchive

The log manual page says some of its commands require root, and collect is normally run with sudo, which asks for your administrator password. The result is a .logarchive package you can open in Console or send to someone. Check what the archive may contain first: logs can include file names, app names and network addresses.

Reading logs in Console

Console is in /System/Applications/Utilities, so Spotlight finds it by name. Below your Mac in the sidebar is a Reports group: Crash Reports, Spin Reports, Log Reports, Diagnostic Reports and Mac Analytics Data (the names as they appear in Console's own resource files). Select your Mac and click Start in the toolbar to stream live messages; the filter bar can narrow them to Errors and Faults. Log Reports lists text logs from the folders above, and the crash, spin and diagnostic views show the files in the DiagnosticReports folders. Select a report and choose Reveal in Finder to see the file behind it.

Streaming is heavy. Console's own warning says streaming log messages will impact system performance, so stop it when you are done.

Crash and hang reports

Crash reports have their own home: DiagnosticReports, once in ~/Library/Logs (your apps) and once in /Library/Logs (system-wide). On the guide Mac they were mostly .diag and .ips files. Spin and hang reports, when there are any, are filed in the same folders. The related post on crash logs covers them in detail.

How big is it and what can go

On the guide Mac: /var/log 167 MB, /Library/Logs 74 MB, ~/Library/Logs 5.6 MB, /var/db/diagnostics 1.8 GB and /var/db/uuidtext 1.3 GB. Check yours with du -sh /var/log /Library/Logs ~/Library/Logs. For the /var/db folders, a standard account gets permission errors; run it from an administrator account.

• Never touch /var/db/diagnostics and /var/db/uuidtext. macOS ages entries out on its own. Deleting parts of the store gains little and loses the evidence you would want next time something crashes.
• Rotated copies in /var/log (.gz, .bz2) come from the system's log rotation, which removes the oldest ones itself.
• App logs in ~/Library/Logs are the safe ones. With the app quit, you can move an old log to the Trash in Finder. Apps recreate them.
• Large single logs such as install.log or a VPN agent's log are better left to rotation. Truncating them with commands is not worth the risk.

Why a search for "log" misses things

Spotlight and Finder searches leave out /var and most of ~/Library, and .tracev3 files have numbered names with no hint of what they contain. Searching for "crash" or "log" in Finder will not show these folders, so the path is the way in.

Finding a specific log by name

Typing install.log, wifi.log or an app's name into Everywhere finds the matching file under /var/log, /Library/Logs or ~/Library/Logs with its full path, and ⌘↵ reveals it in Finder; logs inside sandboxed apps' ~/Library/Containers folders are included once it has Full Disk Access. These folders change constantly, so a log file created a minute ago may wait for the next scan. Names only: it will not look inside a log for an error message, so use log show or Console's search field for that.

Common questions

Where are the log files on a Mac?

System logs are in /var/log and /Library/Logs, your apps' logs are in ~/Library/Logs, and Apple's unified log store is in /var/db/diagnostics.

Where is system.log on macOS?

At /var/log/system.log, but on modern macOS it holds little, since most system messages go to the unified log. It is readable only by administrator accounts; read the rest with log show or the Console app.

How do I read the unified log on a Mac?

Open Console from /System/Applications/Utilities, or run log show --last 30m in Terminal. The underlying .tracev3 files are binary, so a text editor cannot read them.

Can I delete logs to free space on a Mac?

Old app logs in ~/Library/Logs are safe to move to the Trash with the app quit. Leave /var/db/diagnostics and /var/db/uuidtext alone, because macOS manages them.