MacOS Logs – How to Filter Logs via processImagePath

logsmacos

Given the following log entries (which I run in other Terminal to compare my filter):

$ log stream --level debug | grep -w Google
Activity    0x80000000003a7a20   75676  Google Chrome Helper: (CoreFoundation) Loading Preferences From System CFPrefsD For Search List
Debug       0x0                  75676  Google Chrome Helper: (CoreFoundation) [com.apple.CFBundle.resources] Resource lookup at <private>
Debug       0x0                  11599  Google Chrome: (Security) [com.apple.securityd.handleobj] create 0x7fd130d2677a for 0x7fd130d262e0

Note: Removed datetime column for above example for better visibility.

Now I'd like to filter log based on the Google keyword to display log entries from Google Chrome Helper, Google Chrome and Chromium processes.

However the following command doesn't display these entries:

$ log stream --level debug --predicate 'processImagePath contains Google'
Filtering the log data using "processImagePath CONTAINS Google"
Timestamp                       Thread     Type        Activity             PID

I'm following the man log docs page logic as per this example:

$ log show --predicate 'processImagePath endswith "hidd" and senderImagePath contains[cd] "IOKit"' --info

Timestamp                       Thread     Type        Activity     PID
2016-06-10 13:54:34.593220-0700 0x250      Info        0x0          113    hidd: (IOKit) [com.apple.iohid.default] Loaded 6 HID plugins

What I'm doing wrong? Why processImagePath contains Google filter isn't working?

Best Answer

As per Apple support response, string constants must be quoted within the predicate expression.

So the command should have syntax like:

log stream --level debug --predicate 'processImagePath contains "Google"'

See: Creating a Predicate Using a Format String at Apple Programming Guide.

Related Question