macOS logs can explain patching and agent behavior that the Automox agent cannot capture on its own, particularly anything that happens while the device is restarting. This article covers which log to look in and how to read it on current versions of macOS.
Which log do you need?
| Log | Use it for |
|---|---|
/var/log/install.log |
macOS and software update installation. This is usually the right place to start when a patch did not apply as expected. |
/var/log/amagent/amagent.log |
Automox agent activity, including scans, command handling, and connection problems. |
Unified log (log show) |
Everything else the system recorded, including events during startup and shutdown. |
/var/log/system.log |
Legacy only. On current macOS this file holds very little, because most system logging moved to the unified log. |
Update and installation logging
For patch troubleshooting, install.log is the most useful file, and it records installations that occurred during a reboot when the agent had no visibility. View it in Terminal:
cat /var/log/install.log
Or open Finder > Go > Go to Folder, enter /var/log/, and open install.log. For the full procedure including how to hand the file off for review, see How to Retrieve macOS Install.log to View Software Update Logging.
Using the Console app
Open Console with Spotlight by pressing Command+Space, typing Console, and pressing Enter. You can also find it at Finder > Applications > Utilities > Console.
Console shows the live log stream only. It does not display entries written before you opened it, so it is suited to reproducing a problem while watching, rather than investigating something that already happened. To review a past event, use log show as described below.
Console also lists log files on the device, including the ~/Library/Logs folder for the current user, the system-wide /Library/Logs folder, and /var/log for low-level system services. The search bar filters these.
Reviewing past activity with log show
Most system logging on current macOS goes to the unified log rather than to a text file, and the log command is how you read it after the fact. Run these in Terminal.
Show the last hour in a readable format:
sudo log show --last 1h --style syslog
Narrow to a specific process, such as the Automox agent:
sudo log show --last 1h --style syslog --predicate 'process == "amagent"'
Target a specific window when you know roughly when the problem occurred:
sudo log show --start "2026-01-15 22:00:00" --end "2026-01-16 02:00:00" --style syslog
Add --info or --debug to include lower-severity entries, which are excluded by default. Output can be long, so redirect it to a file when you intend to review or share it:
sudo log show --last 1h --style syslog > ~/Desktop/macos-log.txt
Automox agent log
The agent writes to /var/log/amagent/amagent.log. View the end of it live with:
sudo tail -f /var/log/amagent/amagent.log
If you would rather not work directly on the endpoint, the agent log can be collected remotely. See Retrieving Automox Agent logs, or return the log to the Activity Log using the approach in Display the amagent.log in the Activity Log for Linux and macOS.