How to Retrieve macOS Install.log to View Software Update Logging

Issue

A macOS software update or third-party patch reports a failure in the Automox console, or an OS update appears to do nothing after the device reboots. The Automox activity log shows the agent's side of the operation, but the macOS side of the installation — Apple's softwareupdate service, the package installer, and disk image mounting — is recorded by macOS itself in the install log. This article covers how to retrieve that log, most commonly to review it or attach it to an Automox Support case.

Environment

• Automox (current agent release)
• macOS (Intel and Apple Silicon)

Resolution

Option 1 — Read the file directly

1. Open the Terminal application.

2. View the log:

   cat /var/log/install.log
   

3. To watch entries appear live while an update runs:

   tail -f /var/log/install.log
   

4. To narrow the output to update-related entries:

   grep -i "softwareupdate\|installer\|PackageKit" /var/log/install.log
   

Administrative permissions may be required; prefix commands with sudo if the file cannot be read.

Option 2 — Use Finder

1. Open Finder and choose Go > Go to Folder.
2. Enter /var/log/ and press Return.
3. Locate install.log. Copy it to a user-accessible location (for example, the Desktop) to open it in a text editor or attach it to a support case.

Option 3 — Use Console.app

1. Open Console.app from Applications > Utilities.
2. In the sidebar under Reports, select Log Reports.
3. Locate and open install.log.

Option 4 — Unified logging (log show / log collect)

The install log covers installer and software update activity, but the macOS unified log captures surrounding system context. To pull recent update-related unified log entries:

log show --last 2h --predicate 'process == "softwareupdated" OR process == "installd" OR process == "system_installd"'

To capture a full log archive for a support case:

sudo log collect --last 2h --output ~/Desktop/device.logarchive

Rotated copies of the install log (install.log.0.gz and similar) also live in /var/log/ and cover earlier dates.

Notes

• The install log is the authoritative record for anything that happens during a reboot-time OS update, when the Automox agent cannot capture output.
• When opening a support case about a failed macOS update, include /var/log/install.log (plus rotated .gz copies covering the failure window) and the Automox agent log at /var/log/amagent/amagent.log — matching timestamps between the two logs is what makes root cause visible.
• Timestamps in the install log are device-local time; policy results in the console may render in a different time zone. Match events by sequence as well as clock time.