oslo

An os_log viewer for iOS and macOS that supports streaming both real-time logs and archived logs.

• Real-time and archived log viewing
• Unredacts <private> values in log messages
• Advanced filtering by process name, PID, and content with inclusion/exclusion rules
• Time-based filtering
• Syntax highlighting
• Process grouping
• JSON output support

Usage

oslo [process] [filters] [options]

Process Selection:

• <name> — Process name (case insensitive substring match)
• <pid> — Process ID
  (Shows all processes if omitted)

Filters:

• -L, --level <level> — Log level (notice, debug, info, error, fault)
• -a, --after <time> — Show logs after given time
  (Formats: -1h, -30m, -1d, -1w, HH:mm:ss, YYYY-MM-DD, YYYY-MM-DD HH:mm:ss)
• -b, --before <time> — Show logs before given time (same formats as --after)
• -c, --contains <text> — Only include messages containing text (case-insensitive)
• -e, --exclude <text> — Exclude messages containing text (case-insensitive) (--contains/--exclude can be used multiple times for AND matching)
• -i --image <text> — Filter logs by sender image/library path

Options:

• -l, --live — Live logs (default)
• -s, --stored — Stored logs
• -g, --group — Group by process (only for stored logs)
• -j, --json — JSON output (not available in live mode)
• -f, --file <path> — Write output to a file
• -r, --repeats - Drop repeated messages (default: show all repeats)
• -N, --no-color — Disable color output
• -S, --strip - Strip newlines from output
• -h, --help — Show usage information

Usage Examples

# View live SpringBoard logs
oslo springboard|SpringBoard|spr*N*

# View error logs from Notes app in the last 5 minutes
oslo notes --level error --after=-5m
# Error logs up to, but not after, 1 hour ago
oslo notes --level error --before=-1h
# Last 7d, and include all logs that contain 'error'
oslo notes --after=-7d --contains "error"

# Chain multiple contains/exclude filters (AND matching)
oslo --contains "network" --contains "error" # Logs containing both terms
oslo --exclude "timeout" --exclude "retry"   # Exclude logs with either term
oslo --contains "error" --contains "connection" --exclude "timeout" --exclude "retry"

# Filter by specific frameworks or libraries
oslo --image "NetworkExtension"  # Logs from NetworkExtension framework
oslo --image "/System/Library/Frameworks/Foundation.framework"
oslo --image "UIKit" --contains "error"  # Combine with other filters

# Find details about crashes that occurred while logs were not being monitored.
# Case insensitive, wildcard supported
oslo springboard --stored --contains "caught exception" --exclude "ReportCrash"
oslo springboard -s -c "*Exception" -e "simulated_crash"

# Export filtered logs to file
oslo springboard --level=error --file=errors.log

# View all stored logs from the last 24 hours and export to JSON
oslo --stored --after=-1d --json > logs.json

# Show all logs containing "network error" but exclude those with "timeout"
oslo --contains "network error" --exclude "timeout"

# Follow live logs from a PID and write to a file
oslo 12345 --file=logs.txt

Requirements

• macOS 11.5 or later
• Jailbroken iOS 14.0 or later
  • Earlier versions may work. iOS 14.0 - 18.2 tested
  • Rootless or rootful
• Pre-compiled releases for iOS include armv7, armv7s, and arm64 slices

Screenshots

Live log streaming

Stored logs grouped by PID

Credits

• Theldus for the kat syntax highlighting library