Month 6: The Device Doctor's toolkit

What sysdiagnose collects

sysdiagnose gathers system logs, crash and hang reports, network and power state and much more into one archive. AppleCare or the app developer can then see what happened. Reproduce the problem first, note the time, then capture right away.

Exam tip The archive can include personal information. Get the user's OK before sending it anywhere.

How to capture it

Each device has a shortcut.

• iPhone or iPad: press and hold both volume buttons and the side (or top) button for about 1 to 1.5 seconds; release at a short vibration
• Buttons not working: AssistiveTouch menu > Analytics
• Mac: press Shift-Control-Option-Command-Period; the screen flashes, and after a few minutes Finder opens the file
• Mac Terminal: sudo sysdiagnose; Activity Monitor: System Diagnostics option

Submitting it

On Mac the file is saved in /private/var/tmp as sysdiagnose_<date>_<name>.tar.gz. Attach it to the AppleCare case or the developer's ticket, or upload it with Feedback Assistant. Large files may need the support case's upload link rather than email.

Maya: A sysdiagnose taken right after the problem is worth ten taken the next day.

Where it appears

After about 10 minutes, open Settings > Privacy & Security > Analytics & Improvements > Analytics Data. Find the file whose name starts with sysdiagnose_ and matches the time you noted (sysdiagnose_YYYY.MM.DD_HH-MM-SS...). Tap it, then the Share button to AirDrop it to a Mac (it lands in Downloads) or attach it to email.

Exam tip Search for "sys" in Analytics Data to find it quickly.

Getting it with a Mac

Or connect the device to a Mac and sync it in Finder. The file is copied to the hidden Library folder: ~/Library/Logs/CrashReporter/MobileDevice/<device name>/DiagnosticLogs/sysdiagnose. Hold Option and choose Go > Library in Finder to see it.

Rosa: So my driver presses three buttons, waits ten minutes, and AirDrops it to you?

You: Exactly. Then I send it to Apple or the app vendor.

Opening System Report

Choose Apple menu > System Settings > General > About, then System Report. Or hold Option and choose Apple menu > System Information. The report has three groups: Hardware, Network and Software (including installed apps, extensions, logs and profiles).

Rosa: Hold Option and the menu changes? Macs have secret menus!

Exam tip File > Save creates a report file you can attach to a ticket.

Hardware sections worth knowing

Compare what the report shows with what should be there.

• Power: battery cycle count, condition (Normal or Service Recommended), maximum capacity, charger
• USB and Thunderbolt/USB4: is the device on the bus? Missing = cable, port, hub or device power
• Storage / NVMExpress: capacity, SMART status (Verified or Failing)
• Memory, Graphics/Displays, Bluetooth, Camera, Audio

Exam tip Device missing from the USB list = the Mac doesn't see it at all. That's a cable, port or device fault, not a driver or app problem.

When to run Apple Diagnostics

If the report points to failing hardware, run Apple Diagnostics: on Apple silicon, hold the power button to startup options, then press Command-D. It tests hardware and gives reference codes for AppleCare.

Rosa: Service Recommended on the battery. That explains lunch.

You: And the scanner only shows on the USB list with a different cable.

A live view of the Mac

Activity Monitor (Applications > Utilities) shows every running app and process, in real time, across tabs: CPU, Memory, Energy, Disk and Network (plus Cache when Content Caching is on). Sort a column to find what's using the most.

• CPU: % CPU per process; a stuck process near 100% heats and slows the Mac
• Memory: the Memory Pressure graph (green fine, yellow watch, red needs more memory or fewer apps)
• Energy: Energy Impact and apps that prevent sleep; battery drain suspects
• Disk and Network: which process reads, writes or sends the most

Rosa: Memory pressure is red on my Mac. Is that why it crawls?

You: Probably. Close a few apps and watch it go green.

When to open it

Use it when the Mac is slow or hot, the fans are loud, the battery drains, an app hangs, or the network seems busy. It answers "what is the Mac doing right now?" Console answers "what happened, and when?"

Dev: Slow Mac at four? I bet my inventory app is eating the CPU.

The diagnostics menu

Click the system diagnostics options pop-up (the More button with three dots, or the gear in older versions) in the toolbar.

• Sample Process: records what a selected process does over about 3 seconds
• Run Spindump: a report for unresponsive apps that were terminated with Force Quit
• Run System Diagnostics: the full sysdiagnose archive
• Run Spotlight Diagnostics: a report for Spotlight search problems

Exam tip Hung app still running? Sample it first: a sample needs the live process. Spindump covers unresponsive apps that ended up being force quit.

Quit or Force Quit

Select the process (hung ones say (Not Responding) in red), click the Stop (X) button in the toolbar, then choose:

• Quit: like File > Quit; the app closes when it's safe to
• Force Quit: stops it immediately; unsaved data is lost and dependent processes may misbehave
• Processes owned by other users or the system may need an admin password

Exam tip Don't force quit system processes you don't recognize (such as WindowServer or kernel_task). Find out what they are first.

Seeing the family tree

View > All Processes, Hierarchically shows which processes started which. Quitting a parent can take its children with it. View > Send Signal to Process is for advanced cases.

Priya: Try Quit first. Force Quit is for when Quit gets ignored.

The Mac's log viewer

Console (Applications > Utilities) shows log messages from the Mac and from connected iPhones, iPads and other Apple devices, plus saved reports. Use it to find errors, crashes, hangs and patterns around the time a problem happened. Non-admin users need an admin password to see log messages.

• Click Start to stream live messages; Pause to stop
• Search by text, process, subsystem or category; save searches
• Errors and Faults button: show only problems
• Message dots: red = Fault, yellow = Error

The Reports sidebar

Saved reports sit under Reports in the sidebar:

• Crash Reports: an app quit unexpectedly
• Spin Reports: an app or process hung (spun)
• Log Reports: log files such as install.log and wifi.log
• Diagnostic Reports and Mac Analytics Data: system-level reports

Exam tip Live log = what's happening now. Reports = what already happened. Start with Reports for a crash at 4:02.

Reading a crash report

A crash report names the process, its version, the exception type and the crashed thread, with the code it was running. A third-party library on the crashed thread points at a plug-in or vendor code.

Process:   KibbleStock [2214]
Version:   4.2 (412)
Exception: EXC_BAD_ACCESS (SIGSEGV)
Crashed Thread: 0
0  libKCLabels.dylib  render + 88
1  KibbleStock        print + 410

Exam tip EXC_BAD_ACCESS = the app touched memory it shouldn't. Usually an app or plug-in bug, not hardware.

Hangs and errors

A spin (hang) report shows where a process was stuck: waiting on the network, the disk or a lock. In the live log, filter by the process name and the time of the problem, then switch to Errors and Faults. Repeated errors just before a crash often explain it.

• Same crash in the same library every time: update or remove that plug-in
• Crashes in many different apps: suspect the system, hardware or memory, and run Apple Diagnostics
• Hang reports pointing at network waits: test the network the app uses

Dev: libKCLabels... that's the label printer plug-in we installed last month!

What Console is

Console (Applications > Utilities) shows the Mac's unified log: messages from apps, system processes and the kernel, plus crash and diagnostic reports. You can stream live messages, search, and filter by process, subsystem or message type (errors and faults).

• Log reports: crash reports, spin/hang reports, diagnostic reports
• Start streaming to watch messages while you reproduce a problem
• Select a connected iPhone or iPad in the sidebar to stream its log too

When to use it

Reach for Console when something fails without a clear message: an app that quits on launch, a printer that won't respond, a login item that hangs, Wi-Fi that drops. Start streaming, reproduce the problem, then search for the app or process name and look for errors around that time. Crash reports tell you which app and thread crashed and why.

Exam tip Console reads logs; it doesn't fix anything. Activity Monitor shows live CPU/memory use; System Information lists hardware and software; Console explains what went wrong.