Why kernel log is empty?

My macOS 10.12.3 crashed while suspended and I want to look in the log files to determine where the problem comes from.

I opened System Information and in the Logs I found a Kernel log entry linked to /var/log/asl. But this file is empty. Why?

Solution 1:

As of 10.12, macOS no longer primarily logs to text files. However, you can interrogate the stored log data using the log(1) command on the command line in concert with the Console application (found in /Applications/Utilities).

For example, to see all log entries generated by the kernel during the last day in old-fashioned syslog-style text, you can do:

log show --predicate 'processImagePath contains "kernel"' --style syslog --last 1d

(You can also use --start and --end flags if you want to restrict the time window more accurately.)

Alternatively, you can collect all logs from the past day into a bundle called system_logs.logarchive in the current directory by doing:

sudo log collect --last 1d

You can then open this bundle in the Console app (this takes a little while), and in the Search field type process:kernel to find all the log entries generated by the kernel.

I suggest a thorough reading of the log(1) man page (as well as the other resources it points to), plus some experimentation.

Solution 2:

Likely because on MacOS, this log is located at /private/var/log/asl

Here is a tip that I use: given symlinks and hidden folders (plus confusing Unix man), it can be a challenge to find these logs and system reports. Simply open Console, and you will see a list of all the logs and reports.(you will find the one you want under the heading /var/log). Simply right click on the log, and choose 'Reveal in Finder' and it will open directly to the log location!