More useful information gleaned from sysdiagnose

So you have run sysdiagnose and got its 1500 or so output files – or perhaps you are wondering whether they would be worth the effort. What can you gather from browsing that output?

If you are an Apple-trained Genius, there will be a lot more, of course, but here is a quick cruise through some of the more meaningful output files.

The Accessibility folder contains user-by-user copies of Accessibility preference settings. These are valuable because, when inadvertently set, they can account for all sorts of strange problems which users can encounter. My Q&A pages are full of reports of strange occurrences which turned out to be caused by this.

acdiagnose-501.txt is a detailed collection of account information for the active user; other users active at the time will have different user IDs to form the filename. This starts with a summary of all managed accounts, including the Apple ID, mail accounts and some social media, following which there are details about each in turn. These include the date of the last occasion on which credential renewal was rejected, and much more. This can be very helpful if you are having problems with any of those services. Note that passwords are not revealed.

airport_info.txt gives details of AirPort network connections, if AirPort is turned on, and is valuable for tracking down WiFi problems.

apsd-status.txt gives details for the Apple Push Notification service daemon, listing all the services which are waiting for push notifications. If you are having problems with notifications, this should be valuable.

The brctl folder is all about iCloud, as brctl is the shell command to manage the CloudDocs daemon. The contents of this folder are extensive and complex, but can give insight into iCloud problems.

The crashes_and_spins folder contains text diagnostic dumps for recent crashes and freezes (with the spinning beachball cursor). These can be useful at times, but in general, like regular crash reports, most of the information contained is only meaningful when you know the internals of the app in question.

dig-results.txt lists all recent DNS lookups, for example those which you may have initiated by running ping. It does not contain app-directed DNS lookup information.

disks.txt gives a succinct summary of all mounted filesystems, including those using standard devices such as /dev/disk2, and those which are mapped. The iused and ifree values given refer to inodes.

diskutil.txt lists all the currently mounted disk devices, such as /dev/disk2, and gives basic information about each, then provides full details for each. This is generally very useful information for a variety of both hardware and software issues.

error_log.txt is the error log output for sysdiagnose.

find-system-migration-history.txt lists all migrations which have been recorded by the Migration Manager, revealing where you can find their further details.

footprint-all.txt is the output from the shell command footprint, which gathers memory information about all active processes. This is a huge file with more information than anyone could possibly know what to do with, but could be useful if you are having problems with memory management.

fs_usage.txt is the output from the shell command fs_usage, which reports system calls and page faults related to filesystem activity. Again this is unlikely to be meaningful to many.

fsck_hfs_user.log is the log for fsck_hfs calls made for the user. These are typically when you mount a disk or disk image, so can occur when installing apps, etc. Each run gives the name of the volume which was checked in its last line.

fsck_hfs_var.log is the log for fsck_hfs calls made on removable disks (rdisk devices). These should be quick checks only, finding the filesystems clean.

gpt.txt is a short report on GUID partition tables, using the gpt shell command, and details the health of all known partition tables for disks.

The [Mac name].mdsdiagnostic folder contains one or more files, including diagnostic.log. That provides a full report on the mds metadata server, with Spotlight and related information.

ifconfig.txt contains the output from the shell command ifconfig, which details the configuration of all network interfaces. A short file containing similar information to that obtainable from Network Utility, it is essential reading for network diagnosis.

The ioreg folder contains a suite of text files detailing all the I/O Kit settings, including known devices, USB, etc. This is heavy information and unlikely to be useful to many.

ipconfig.txt lists the IP configuration state, which is likely to be terse and unhelpful.

kextstat.txt is a detailed listing of loaded kernel extensions (KEXTs). Although almost all should now be Apple’s, this is an important file when there could be extension problems, and for eliminating the role of third-party KEXTs.

A series of files with names starting launchctl- provide detailed information about daemons, agents, and services which have been launched by launchd. launchctl-list-0.txt contains information about those owned by the root user, and launchctl-list-501.txt etc. for those owned by other users, according to the user ID given. Next to KEXTs, these are generally important in diagnosing software issues.

locale-501.txt (or another user ID) gives locale information, including keyboard layout.

The logs folder includes a lot of otherwise hidden logs, which I will delve into in a separate article.

lsappinfo.txt contains information about launch services, from the lsappinfo shell command. This includes all the visible apps which have been started, and several which the user may not be aware of. This is another generally valuable report.

lskq.txt is the output from the lskq command, which details kqueues and registered kevents of running processes. This is very specialist.

lsof.txt lists all open files, usually very long and of doubtful value to most users.

mount.txt details mounted volumes and those which are mapped. This is short and sweet, and should be the same as in disks.txt.

The netstat and network-info folders contain important information about network connections. netstat details active Internet connections and routing tables, just as when invoked in Network Utility. network-info contains relevant setting files (plists) and further information. These are important when dealing with local network and Internet problems.

odutil.txt lists information about Open Directory configuration and use. An understanding of Open Directory is important to make much sense out of this.

pluginkit-501.txt (or another user ID) details registered plugins, and can be valuable when grappling with some software problems which could relate to plugins.

pmset_everything.txt contains all power management settings, which is invaluable when dealing with a problem related to sleep of various kinds, and other power management issues.

powermetrics.txt is a very detailed compilation of CPU usage statistics. Although a lot of this could be useful information, few will be able to interpret it, I suspect.

ps.txt and ps_thread.txt are the output from ps, detailed here.

scutil.txt is the output from the scutil shell command, usually a short list of name resolvers used. This is essential study when there are network/Internet DNS resolver problems.

smcDiagnose.txt is the SMC diagnostic dump, and not meaningful to anyone other than an Apple engineer.

spindump.txt is the output from the spindump shell command, which profiles the system for a period, normally 10 seconds at 10 ms sampling intervals. Although this can be invaluable when dealing with performance issues, it is very technical.

sysctl.txt details the kernel state. This is fascinating stuff for kernel hackers, but unintelligible to mere mortals.

sysdiagnose.log is the log output from sysdiagnose.

system_profiler.spx is a standard System Report XML file which can be opened by the System Information app, detailing hardware and software configuration. This is invaluable for anyone performing remote diagnosis.

The SystemConfiguration folder contains a set of important settings files, plists, which can be helpful to anyone needing to know those settings.

talagent-501.txt (or another user ID) contains the output from talagent, the helper for the Transparent App Lifecycle feature. This performs various ‘smart’ app management tasks, including resume, and shutting apps down when resources run short.

taskinfo.txt shows the policy information from the kernel, as generated by the taskinfo command. This is unlikely to be of much help.

thermal.txt is a short file containing information about hardware thermal threshold settings. This is of limited relevance.

top.txt is the output from the top tool, detailed here.

vm_stat.txt is a compilation of Mach virtual memory statistics from the vm_stat command. Although not large, this is likely to be of limited use.

zprint.txt contains information about kernel zones from the zprint command, which is unlikely to be generally useful.