Skip to main content

Apple System Logs (ASL)

It is surprising the number of times a mobile app logs the actual credentials you use to login to the app to the device syslog facility. The easiest way to review the logs is to use the iOS Console on your Mac, with the device connected via the USB cable. The app allows you to filter the output down to your app.

iOS Log Console​

To view the system log on the device, connect the device via the USB cable. Launch the Console application on the Mac (Applications --> Utilities --> Console). Select the device from the left side, under the section labeled "Devices". You can use the Search bar in the top right to filter the log.

Console App

idevicesyslog​

If you have installed the libimobiledevice package (which you should have), then you can also use the idevicesyslog command on the Terminal to review the ASL from the device.

% idevicesyslog 
[connected]
Jan 17 15:39:18 locationd[5332] <Notice>: MotionCoprocessor,startTime,664144758.214144,motionType,1,youthType,0,youthTypeReason,0
Jan 17 15:39:18 locationd[5332] <Notice>: Current state of Workout Predictor: 0
Jan 17 15:39:18 locationd[5332] <Notice>: os_transaction created: (<private>) <private>
Jan 17 15:39:18 locationd[5332] <Notice>: @WifiLogic, handleInput, System::CoarseMotion

. . . (truncated output)

This will produce the log of everything that the device is logging, which will likely be unusable due to the volume. Instead, we should pipe that output to grep to only get our target applications logs:

% idevicesyslog | grep -i cydia
SBLayoutRolePrimary = <SBDeviceApplicationSceneEntity: 0x28353df40; ID: sceneID:com.saurik.Cydia-default; layoutRole: primary>;
Jan 17 15:39:34 SpringBoard(FrontBoard)[5349] <Notice>: Creating process for executionContext with identity: application<com.saurik.Cydia>
Jan 17 15:39:34 SpringBoard(FrontBoard)[5349] <Notice>: Created <FBWorkspace: 0x2821fc6e0; application<com.saurik.Cydia>>
Jan 17 15:39:34 SpringBoard(FrontBoard)[5349] <Notice>: Bootstrapping application<com.saurik.Cydia> with intent foreground-interactive
Jan 17 15:39:34 runningboardd(RunningBoard)[5321] <Notice>: Acquiring assertion targeting application<com.saurik.Cydia> from originator [daemon<com.apple.SpringBoard>:5349] with description <RBSAssertionDescriptor| "FBApplicationProcess" ID:5321-5349-3109 target:application<com.saurik.Cydia> attributes:[

. . . (truncated output)