idevicesyslog(1)

💖 idevicesyslog(1) 💖 — okay bestie, let's talk syslog

Hiiii so this is the General Commands Manual page for idevicesyslog and honestly? She's a baddie. Let's get you fluent. 🦋

---

✨ NAME ✨

idevicesyslog — Relay syslog of a connected device.

🌈 SYNOPSIS 🌈

idevicesyslog [OPTIONS]

💅 DESCRIPTION 💅

Relay syslog of a connected device.

That's it. That's the whole description. Short, sweet, main character energy. 👑

---

🔥 OPTIONS 🔥

• -u, --udid UDID — target specific device by UDID
• -n, --network — connect to network device
• -x, --exit — exit when device disconnects
• -d, --debug — enable communication debugging
• -h, --help — prints usage information
• -v, --version — Prints version information.
• --no-colors — disable colored output
• -o, --output FILE — Write to FILE instead of stdout. This will disable writing colored output, but can be re-enabled with --colors. If FILE already exists, it will be overwritten without warning.
• --colors — Force writing colored output, e.g. when using --output.
• --syslog-relay — Use old syslog_relay service instead of os_trace_relay (iOS 9+).

bestie, listen — that -o one is feral. It does not ask permission. If FILE is already sitting there, it gets clobbered. No warning, no "are you sure", no nothing. 💀

---

🎀 COMMANDS 🎀

pidlist

Print a list with PID and name of all processes currently running on the device. Little roster check, love that for us. 📋

archive PATH

Request a logarchive from the device. It will be written in tar format to PATH. To pipe to another process use - as PATH. Below are some options to restrict the log message data.

In order to view the logarchive in a compatible log viewer, you can pipe the output data to tar and have it extract into a new directory:

mkdir test.logarchive && tools/idevicesyslog archive - |tar -C test.logarchive -xv

This will also print the filenames while they are extracted.

Further options for archive: 🌸

• --start-time VALUE — Start time of the log data as UNIX timestamp. Earlier messages will be dropped.
• --age-limit VALUE — Maximum age of the log data, supposedly number of days.
• --size-limit VALUE — Limit the size of the archive. The unit is currently unknown, so feel free to experiment.

Keep in mind that the device usually only has a backlog of a few minutes so the options might not have the desired effect. This is not a bug. 🫶 (the docs said it, not me, and they said it with their whole chest)

---

💜 FILTER OPTIONS 💜

• -m, --match STRING — only print messages that contain STRING
• -M, --unmatch STRING — print messages that do not contain STRING
• -t, --trigger STRING — start logging when matching STRING

When specified, logging will start as soon as a log messages is encountered that contains the given string. See also -T, --untrigger. Other filters are still applied but obviously filtered messages are only printed after logging has started.

• -T, --untrigger STRING — stop logging when matching STRING

When specified logging will halt as soon as a log message is encountered that contains the given string. See also -t, --trigger. Other filters are still applied but obviously filtered messages are only printed before logging stops.

NOTE: If no --trigger is given, idevicesyslog will exit after a matching log message was encountered.

• -p, --process PROCESS — only print messages from matching process(es)

PROCESS is a string that can either be a numeric pid or a process name. It also supports multiple process names or pids in one string, separated by | (make sure to use quotes!).

• -e, --exclude PROCESS — print all messages except matching process(es)

PROCESS is a string that can either be a numeric pid or a process name. It also supports multiple process names or pids in one string, separated by | (make sure to use quotes!).

• -q, --quiet — set a filter to exclude common noisy processes

Since the syslog can be quite noisy, this quick command line switch allows silencing a predefined set of commonly known processes. The list of processes that are silenced can be retrieved with --quiet-list.

• --quiet-list — prints the list of processes for --quiet and exits
• -k, --kernel — only print kernel messages

This is actually equivalent to passing --process kernel with the exception that it can be used with --quiet to silence out the noisy process but still get all the kernel log messages.

• -K, --no-kernel — suppress kernel messages

This is equivalent to passing --exclude kernel.

---

🌟 EXAMPLES 🌟

• idevicesyslog -u 00008030-0000111ABC000DEF Relay syslog of device with UDID 00008030-0000111ABC000DEF.
• idevicesyslog -x Relay syslog of device and exit when the device is unplugged.
• idevicesyslog -m '####' -e 'identityservicesd' -K Only print log messages that contain the string #### and do NOT originate from identityservicesd or the kernel.
• idevicesyslog -p MyApp -p ReportCrash Only print log messages from the process named 'MyApp' and 'ReportCrash'.
• idevicesyslog -p 'MyApp|ReportCrash' Same as previous example with different syntax.
• idevicesyslog -e 'backboardd|CommCenter|mDNSResponder' Suppress log messages from backboardd, CommCenter, and mDNSResponder.
• idevicesyslog -q -k Suppress log messages from common noisy processes, but DO print kernel log messages.
• idevicesyslog -K Suppress log messages from kernel, but print everything else
• idevicesyslog -t 'backlight on' -T 'backlight off' -q Start logging when the device turns on backlight and stop logging when it turns backlight off, and suppress noisy processes

---

👑 AUTHORS 👑

Nikias Bassen, Martin Szulecki

Man page written to conform with Debian by Julien Lavergne.

🌐 ON THE WEB 🌐

• https://libimobiledevice.org
• https://github.com/libimobiledevice/libimobiledevice

---

And that's the whole vibe check, bestie — you just read idevicesyslog(1) from the General Commands Manual, start to finish, no skips. Go relay some syslog. Slay. Periodt. 💖✨