idevicesyslog1

Usage

Overview

Relay syslog of a connected device.

Options

-u, --udid UDID

target specific device by UDID

-n, --network

connect to network device

-x, --exit

exit when device disconnects

-d, --debug

enable communication debugging

-h, --help

prints usage information

-v, --version

Prints version information.

--no-colors

disable colored output

-o, --output FILE

Write to FILE instead of stdout. This will disable writing colored output, but can be re-enabled with --colors. If FILE already exists, it will be overwritten without warning.

--colors

Force writing colored output, e.g. when using --output.

--syslog-relay

Use old syslog_relay service instead of os_trace_relay (iOS 9+).

Commands

pidlist

Print a list with PID and name of all processes currently running on the device.

archive PATH

Request a logarchive from the device. It will be written in tar format to PATH. To pipe to another process use - as PATH. Below are some options to restrict the log message data.

In order to view the logarchive in a compatible log viewer, you can pipe the output data to tar and have it extract into a new directory:

mkdir test.logarchive && tools/idevicesyslog archive - |tar -C test.logarchive -xv

This will also print the filenames while they are extracted.

Further options for archive:

--start-time VALUE

Start time of the log data as UNIX timestamp. Earlier messages will be dropped.

--age-limit VALUE

Maximum age of the log data, supposedly number of days.

--size-limit VALUE

Limit the size of the archive. The unit is currently unknown, so feel free to experiment.

Keep in mind that the device usually only has a backlog of a few minutes so the options might not have the desired effect. This is not a bug.

Options

-m, --match STRING

only print messages that contain STRING

-M, --unmatch STRING

print messages that do not contain STRING

-t, --trigger STRING

start logging when matching STRING

When specified, logging will start as soon as a log messages is encountered that contains the given string. See also -T, --untrigger. Other filters are still applied but obviously filtered messages are only printed after logging has started.

-T, --untrigger STRING

stop logging when matching STRING

When specified logging will halt as soon as a log message is encountered that contains the given string. See also -t, --trigger. Other filters are still applied but obviously filtered messages are only printed before logging stops.

NOTE: If no --trigger is given, idevicesyslog will exit after a matching log message was encountered.

-p, --process PROCESS

only print messages from matching process(es)

PROCESS is a string that can either be a numeric pid or a process name. It also supports multiple process names or pids in one string, separated by | (make sure to use quotes!).

-e, --exclude PROCESS

print all messages except matching process(es)

PROCESS is a string that can either be a numeric pid or a process name. It also supports multiple process names or pids in one string, separated by | (make sure to use quotes!).

-q, --quiet

set a filter to exclude common noisy processes

Since the syslog can be quite noisy, this quick command line switch allows silencing a predefined set of commonly known processes. The list of processes that are silenced can be retrieved with --quiet-list.

--quiet-list

prints the list of processes for --quiet and exits

-k, --kernel

only print kernel messages

This is actually equivalent to passing --process kernel with the exception that it can be used with --quiet to silence out the noisy process but still get all the kernel log messages.

-K, --no-kernel

suppress kernel messages

This is equivalent to passing --exclude kernel.

Examples

idevicesyslog -u 00008030-0000111ABC000DEF

Relay syslog of device with UDID 00008030-0000111ABC000DEF.

idevicesyslog -x

Relay syslog of device and exit when the device is unplugged.

idevicesyslog -m '####' -e 'identityservicesd' -K

Only print log messages that contain the string #### and do NOT originate from identityservicesd or the kernel.

idevicesyslog -p MyApp -p ReportCrash

Only print log messages from the process named 'MyApp' and 'ReportCrash'.

idevicesyslog -p 'MyApp|ReportCrash'

Same as previous example with different syntax.

idevicesyslog -e 'backboardd|CommCenter|mDNSResponder'

Suppress log messages from backboardd, CommCenter, and mDNSResponder.

idevicesyslog -q -k

Suppress log messages from common noisy processes, but DO print kernel log messages.

idevicesyslog -K

Suppress log messages from kernel, but print everything else

idevicesyslog -t 'backlight on' -T 'backlight off' -q

Start logging when the device turns on backlight and stop logging when it turns backlight off, and suppress noisy processes

On the web

https://libimobiledevice.org

https://github.com/libimobiledevice/libimobiledevice