Show private log messages in Console.app

The new Console app in Sierra was a complete redesign, but also came with an entirely new logging mechanism. This changed much about the way logging works on macOS. No longer are there separate files for individual logs, but rather a Unified Logging mechanism which centralises the logs into a single database. You can find more information about Unified Logging in the WWDC 2016 session.

Most notably for users, this change affects the way sensitive information is logged. Where the OS (or the app developer) decides that personal information is being logged, it will replace it with <private>. This means it cannot be viewed by other apps on the system, but also means the user has no access to it, as shown in the screenshot below. Many processes such as diskarbitrationd <private> their logs so that others cannot read the information made available through the console, avoiding leaking sensitive information.

Show private logs in macOS Catalina 10.15.3+

The following mobile configuration profile will set the required preference. This profile has been code signed and is verified on installation up to 2022.

Installing this profile will immediately make private logs visible in the Console app.

Removal of the profile can be performed through System Preferences in the Profiles.prefPane. Click the minus button in the bottom left with the profile selected to remove it and hide private logs.

Showing private logs in Catalina before 10.15.3

The private_data mode from Sierra up to Mojave appears to have been removed in Catalina, therefore the previous solution to this issue in macOS Catalina no longer works. However, not all hope is lost. Despite log telling you that private_data is an invalid mode, it's still possible to enable this.

sudo log config --mode "private_data:on"
log: Invalid Modes 'private_data:on'Code language: JavaScript (javascript)

Saagar Jha has done some excellent research on this and discovered that the private_data mode still exists, but is prevented from being changed unless you're an Apple developer. Fortunately, a tool was released in the form of some C++ which you can find on their blog. I've compiled and code signed this code into a binary which you can download and run:

The binary has three options: status, enable and disable. Run the binary without providing an option to print its usage.

$ PrivateLogs
Usage: PrivateLogs <status|enable|disable>Code language: HTML, XML (xml)

To print the current status, whether showing the content behind <private> in logs is enabled or disabled, use status.

$ PrivateLogs status
disabled

To show private logs, run with enable. This must be run with sudo or as root (no error will be shown without root, but no change will occur).

$ PrivateLogs enable
$ PrivateLogs status
enabled

Showing private logs in Sierra

To show all private logs in the macOS Sierra console, run the following command in Terminal:

sudo log config --mode "private_data:on"Code language: JavaScript (javascript)

For app developers, to override the OS’s decision on what should be made private and write publicly to the log, use the following format:

%{public}s