Export Recent System Logs with log collect

Bundle the last hour of unified logs into a .logarchive you can open in Console or send to support.

macOSlogsysdiagnosesupportMedium risk

Run `sudo log collect --last 1h --output ~/Desktop/recent-logs.logarchive` to export recent logs.

01Command

Command

$ sudo log collect --last 1h --output ~/Desktop/recent-logs.logarchive

02What it does

log collect gathers the unified log store (plus spin/dump panic files when run with sudo) into a .logarchive bundle that Console.app and `log show --archive` can read without touching the live store. Time-window flags mirror log show: `--start`, `--end`, and `--last`. For a full system diagnostic including spindumps and network state, the heavier `sysdiagnose` is the companion tool support usually requests.

03Risk

RiskMedium risk

RequirementsmacOS 10.12 or later; sudo for system-wide collection.

!Warning: Log archives can include file paths, Wi-Fi SSIDs, and account identifiers — review before sharing.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

LOG Command: Access log messages in macOS
SS64 · technical · 2026-09-17
Evidence: Documents log collect with --last, --output, and --device-name options producing .logarchive bundles.

Last verified: 2026-09-17 · Category: System & Settings

06Related solutions

Search the Unified Log with log show

macOSlogtroubleshootinglogging

Filter macOS's single unified log by process, message type, or subsystem straight from the Terminal.

Low risk ✓ 2026-09-17