How to Find and Manage Log Files on Mac

Logs are diagnostic breadcrumbs. When apps crash, when systems fail, when something behaves strangely, logs are how engineers figure out why. macOS and every app on your Mac generate them constantly.

Most logs are tiny. A typical app log is a few KB to a few MB. The problem is volume and accumulation. A Mac you’ve used for three years has tens of thousands of log files, and a small percentage of poorly-behaved apps log so verbosely that single log files reach gigabytes.

Here’s how to find every log on your Mac, what each type means, and which ones are safe to clean.

The four main log locations

~/Library/Logs — User-level logs. Most app logs live here.

/Library/Logs — System-wide logs from apps installed for all users.

/var/log — Traditional Unix system logs. Aliased as /private/var/log.

~/Library/Logs/DiagnosticReports and /Library/Logs/DiagnosticReports — Crash reports.

Plus, individual apps may keep logs in their own data folders inside ~/Library/Application Support or ~/Library/Containers.

Finding all log files

To list everything called .log or in a Logs folder:

find ~ /Library /var/log -type f \( -name "*.log" -o -name "*.log.gz" \) 2>/dev/null

Or specifically inside the Logs directories:

find ~/Library/Logs /Library/Logs /var/log -type f 2>/dev/null

To see sizes:

find ~/Library/Logs /Library/Logs /var/log -type f -exec du -h {} + 2>/dev/null | sort -hr | head -50

Top 50 largest logs across all standard locations.

For a focused look at the biggest log directories:

du -sh ~/Library/Logs/* 2>/dev/null | sort -hr | head -20

Top 20 user log directories by size.

What each location holds

~/Library/Logs

Per-app logs from non-sandboxed apps. Subdirectories named after each app:

• Adobe — Adobe app logs
• Audio — Audio MIDI Setup and similar
• Bluetooth — Bluetooth events
• CoreSimulator — Xcode simulator logs (developers only)
• Sentinel — Various Mac Apple security logs
• App-specific subfolders for things like Spotify, Microsoft, etc.

/Library/Logs

System-wide app logs. Contents vary based on what’s installed.

/var/log

Traditional Unix logs:

• system.log.gz — Old rotated system logs
• install.log — Installer activity
• wifi.log — WiFi connection events (rotated)
• daily.out, weekly.out, monthly.out — Periodic system maintenance reports

~/Library/Logs/DiagnosticReports

Crash and hang reports for apps. Files named [AppName]_[date]-[time]_[hostname].crash or .ips. These are what shows up when you Apple Menu → System Report → Reports.

/Library/Logs/DiagnosticReports

Same as above but for system-wide apps. Often includes kernel panics if you’ve had any.

The unified logging system

Modern macOS logs through os_log() API into a structured database, not into text files. The actual data lives in /var/db/diagnostics and isn’t easily browsable.

To query unified logs:

log show --last 1h --predicate 'subsystem == "com.apple.WiFi"'

That shows WiFi-related log entries from the last hour. Useful for troubleshooting but not really cleanup territory — macOS manages this database itself.

To check unified log database size:

sudo du -sh /var/db/diagnostics

If it’s surprisingly large (multi-GB), there may be a logging issue worth investigating, but don’t manually delete the database files.

Crash reports and their sizes

Each crash report is small (10-100KB), but they accumulate. After three years of use, you may have thousands.

To list:

ls -lh ~/Library/Logs/DiagnosticReports/

To count:

ls ~/Library/Logs/DiagnosticReports/ | wc -l

To delete crash reports older than 90 days:

find ~/Library/Logs/DiagnosticReports -type f -mtime +90 -delete 2>/dev/null

Same for system-wide:

sudo find /Library/Logs/DiagnosticReports -type f -mtime +90 -delete 2>/dev/null

Crash reports older than three months rarely have ongoing diagnostic value. If a crash recurred recently, the recent report has the relevant data.

Skip the manual huntSweep finds the largest, oldest, most-forgotten files in seconds. Download Sweep free →

When logs go rogue

Some apps log so verbosely that single log files balloon. Watch for:

Multi-gigabyte single .log files — Almost always a bug or excessive logging level setting in the app. Kill the file (after stopping the app) and let it start fresh.

Adobe logs — Adobe apps occasionally generate massive logs during Sync issues. Check ~/Library/Logs/Adobe and ~/Library/Logs/CreativeCloud.

Compiler / Xcode logs — If you’re a developer, ~/Library/Logs/CoreSimulator can grow extreme.

Game launcher logs — Steam, Epic, Battle.net all log heavily. Check their respective directories.

To find any single log over 100MB:

find ~/Library/Logs /Library/Logs /var/log -type f -size +100M 2>/dev/null

These are the outliers worth investigating. A 2GB log file isn’t normal.

Clearing logs safely

For most logs, deletion is safe. Apps create new log files when they need to log; deleting old ones doesn’t break anything.

Bulk clear of user-level logs older than 30 days:

find ~/Library/Logs -type f -mtime +30 -delete 2>/dev/null

For system-wide:

sudo find /Library/Logs -type f -mtime +30 -delete 2>/dev/null

For /var/log compressed archives:

sudo find /var/log -type f -name "*.gz" -mtime +30 -delete 2>/dev/null

Don’t delete files currently in use. If an app is running, its current log file is open; deleting causes weird behavior on some apps. The mtime +30 filter mostly avoids this since current logs were modified recently.

There’s a faster waySmart Folders work but take setup. Sweep does the same hunt instantly. Try Sweep free →

Console.app for live log viewing

If you want to watch logs in real-time, use Console.app (in Applications → Utilities).

Console shows the unified log stream. Filter by app, by message text, or by log level. Useful for troubleshooting but not for cleanup.

For static log files (the .log files in ~/Library/Logs), Console can also open them. Drag a .log file onto Console and it’ll show the contents in a readable format.

Log files that tell you something useful

Worth checking before deleting:

~/Library/Logs/CrashReporter — If you’re noticing app instability, recent crashes here may indicate which app.

/var/log/install.log — Records every installer that ran. Useful for “what did I install last week and how big was it?”

~/Library/Logs/DiagnosticReports/[App].ips — IPS files are the modern crash report format. The file name includes the app and timestamp.

~/Library/Logs/CreativeCloud/ — Adobe activity. If Adobe apps are misbehaving, this is the first place to look.

A quick read of recent logs (within the last week) can reveal patterns: an app crashing repeatedly, a system service throwing errors, network hiccups.

Logs vs. cache vs. application support

Worth distinguishing. Log files record what happened. Cache files store data for fast re-access. Application support stores app state and user data.

When in doubt about a file, the location tells you:

• ~/Library/Logs/[anything] = log
• ~/Library/Caches/[anything] = cache
• ~/Library/Application Support/[anything] = app data (handle carefully)

Logs are the most safely deletable category. Caches are second. Application support is most cautious — that’s where actual app data lives.

A regular schedule

Logs grow at a slow but steady pace. Quarterly cleanup is plenty for most users. Set a calendar reminder for the first weekend of each season.

The fastest method:

find ~/Library/Logs -type f -mtime +30 -delete 2>/dev/null
sudo find /Library/Logs -type f -mtime +30 -delete 2>/dev/null
sudo find /var/log -type f -name "*.gz" -mtime +30 -delete 2>/dev/null
find ~/Library/Logs/DiagnosticReports -type f -mtime +90 -delete 2>/dev/null

Four lines. Removes routine log cruft older than 30 days plus crash reports older than 90 days.

For people who don’t want to run Terminal commands, a cleaning tool catches log accumulation as part of standard scans. Logs are typically a small fraction of total disk space (1-5GB on most Macs), but they’re satisfying to clear because they’re pure cruft — nothing’s lost when they go.

The only reason to keep logs is active troubleshooting. If you’re not currently debugging something, last quarter’s logs add nothing.