Guide

How to read a log file on a Mac

A log is a file you read under pressure: something is wrong, the file is large, and the part you need is somewhere in the middle. Here is what the Mac already gives you, what it cannot do, and how to read a very large log without waiting for anything.

What the machine already has

tail -f app.log follows a file as it is written and is still the fastest way to watch one line arrive. less +F does the same and lets you stop and scroll. grep -n ERROR app.log finds the lines with a word in them. Console.app reads the system's own logs and nothing else.

What none of them does is let you read: they show you text in one colour, they answer one question per command, and the moment you want "the errors, but with the stack trace under each one, and also the two requests with this id" you are writing a pipeline rather than reading a log.

Why editors struggle here

Most editors read a whole file before showing it. A 6 GB log therefore costs 6 GB of memory plus whatever the editor adds — which on many machines means it never opens at all. The ones that do open it usually refuse to highlight it, refuse to wrap it and redraw a screenful slowly enough that scrolling is unpleasant.

Reading a log in Volt

It opens instantly whatever the size — the measured case is a 4.23 GB log of 50.4 million lines in two milliseconds — and everything after that is the same speed at the end of the file as at the start.

It knows it is a log, from the lines rather than the name. server.out, syslog, catalina.2026-09-10: what decides is that most of the first two hundred lines start with a time. Then every line is coloured for what is in it — the time, the level, addresses, identifiers, HTTP methods, exceptions, key=value pairs and durations — so a wall of text becomes something with a shape.

Errors are red and warnings amber, and both are marked down the scroller, so you can see from anywhere in the file where it went wrong. A line that does not start with a time — the forty lines of a stack trace under the error that threw it — belongs to the record above it, and is treated that way by everything that filters.

Show Only Errors, and Show Only Errors and Warnings, hide everything else and keep each record's own lines with it. Find ▸ Show Only Matching Lines (⌥⌘L) does the same for any search, Hide Matching Lines (⌥⇧⌘L) is the other way round, and Filter Lines… takes several conditions at once — show lines with ERROR, hide the healthcheck, show user=\d+ as a regular expression — each one a switch you can turn off again. The lines stay editable while they are filtered.

Mark All Matches keeps a search painted in one of five colours while other searches come and go. Reading a log with three things to watch — a request id, an error code, a user — is three markers rather than three searches that each forget the one before.

Go to Time… goes to the first line at or after a moment: 14:03 on the day of the line you are on, a full date and time, or +5m and -1h from here. This is the command that replaces scrolling and guessing.

A file that grows is followed: new lines are added to what is on screen as they are written, so a window can sit in the corner of the screen doing what tail -f does — and a window can be made two lines tall for exactly that. When a log is rotated and a new file takes its name, the window picks it up and your filters are still on.

Rotated and compressed logs

access.log.1.gz opens as its text and saves back compressed. So do .bz2, .zst and .xz, and so does a .gz made of several members — which is what you get when rotated logs are appended to one file. No unpacking step, no temporary copy, nothing to tidy up.

When the log is not text you recognise

Logs off an appliance, a mainframe or an embedded system are often not UTF-8 at all. Volt detects the character set when the file opens, says which one it chose in the status bar, and lets you re-read the bytes in another set if it was a close call. A file with no line feeds in it — records, or lines separated by NEL — is read as lines rather than as one enormous one.

Questions

Related

• Opening large files on a Mac — the measured figures and what the built-in tools do.
• Opening a large CSV on a Mac — tables, separators and encodings.
• Editing a .gz without unpacking it — rotated logs, dumps and backups.
• Everything Volt does — the complete list, searchable.