pymobiledevice3 syslog

Stream the device's live system log, or collect it into a .logarchive.

live-old

Stream raw syslog lines from the legacy syslog_relay service; runs until Ctrl+C.

pymobiledevice3 syslog live-old [OPTIONS]

Options:

Option

Description

--native

macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

live

Stream the device's live system log with filtering and coloring; runs until Ctrl+C.

pymobiledevice3 syslog live [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
-o, --out <path>	Save every log entry to this file. NOTE: stdout is not suppressed — entries are printed to both stdout and the file (tee-like). Redirect stdout with '>/dev/null' to keep only the file.
--pid <int>	Only entries from this PID. -1 for all. [default: -1]
-pn, --process-name <str>	Only entries from the process with this name.
-m, --match <str>	Keep only lines containing this text (repeatable; all must match).
-v, --invert-match <str>	Drop lines containing this text (repeatable; any match drops the line).
-mi, --match-insensitive <str>	Keep only lines containing this text, ignoring case (repeatable; all must match).
-vi, --invert-match-insensitive <str>	Drop lines containing this text, ignoring case (repeatable; any match drops the line).
--label	Include the subsystem/category label in the rendered line (JSON output always emits the label field).
-e, --regex <str>	Keep only lines matching this regex (repeatable; any one may match).
-ei, --insensitive-regex <str>	Keep only lines matching this regex, ignoring case (repeatable; any one may match).
-s, --subsystem <str>	Keep only entries whose os_log subsystem matches this case-insensitive glob (e.g. 'com.apple.WebKit*'). Repeatable; an entry is kept if it matches any (disjunction). Entries with no subsystem/category label are dropped when set.
-c, --category <str>	Keep only entries whose os_log category matches this case-insensitive glob (e.g. 'Network'). Repeatable; an entry is kept if it matches any (disjunction). Combined with --subsystem as a conjunction (both must match).
-io, --image-offset	Include image offset in log line (text mode only; JSON always emits image_offset).
--no-debug	Suppress DEBUG entries.
--no-info	Suppress INFO entries.
--start-after <str>	Start printing only after this string is seen.
--format <text\|json>	Output format. 'json' emits one JSON object per line (NDJSON). Filters match against the rendered text line in both formats. [default: text]

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.

collect

Collect the system logs into a .logarchive for later viewing with log show or Console.

OUT is the .logarchive directory itself; give it a .logarchive suffix so those tools recognize it.

pymobiledevice3 syslog collect [OPTIONS] {out}

Arguments:

Argument	Description
out	Directory to extract the archive into (created if missing), e.g. system_logs.logarchive. [required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--size-limit <int>	Maximum size of the archive, in bytes.
--age-limit <int>	Only include entries up to this many days old.
--start-time <int>	Only include entries from this time on, as a unix timestamp.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.