What you will achieve

Use Console.app to find errors and correlate system failures with timestamps.

Console streams unified logs from macOS and applications — more signal than guessing. Filtering by process and timestamp correlates user-visible glitches with background errors. Export subsets for vendor support instead of screenshotting scrolling text.

1) Open and orient

Applications → Utilities → Console. Select your Mac in sidebar under Devices. Start streaming shows live logs — pause to freeze.

2) Filter effectively

Search bar: error, fault, process name (e.g. backupd, kernel).
Subsystem filter for specific app bundles.
Click timestamp column to align with when issue occurred.

3) Crash vs spin

Crash reports appear under Reports — separate from unified log. Kernel panics in DiagnosticReports as .ips files.

4) Export for support

Select log lines → Save. For Apple or vendor tickets, attach panic-full and app crash .ips from same minute.

5) Do not panic at noise

Many “error” lines are benign retries. Look for repeating patterns at exact failure time, not one-off background chatter.

6) Persist logs

Console shows unified log with ~30 day default retention — older events need archived diagnostics or Time Machine backup of /var/log if existed pre-unified.

7) log stream command

log stream --predicate 'eventMessage contains "error"' --level error

Terminal alternative for live filtering when GUI overwhelms.

8) Privacy in exports

Redact account emails and serial numbers before posting logs publicly — panic files include hardware UUID.

Verify

You can reproduce filter that shows only lines around a known test failure; exported file opens in text editor.

Additional troubleshooting notes

If steps above do not resolve the issue on the first attempt, reboot once, confirm System Settings → General → Software Update is current, and retry with a second administrator account to rule out profile or keychain corruption in your daily user. Document exact error text from Console.app with timestamp — vague “it still fails” without logs wastes support time. On Apple Silicon, re-test after full shutdown (not just restart) because firmware and Thunderbolt controllers reset only on cold boot. Intel Macs should repeat test in Safe Mode to bypass third-party login items. Before erase or keychain reset, verify Time Machine or clone backup completed — batch 3 guides assume Monterey/Ventura/Sonoma/Sequoia paths in System Settings; search Spotlight for renamed panes if your macOS version labels differ slightly.