---
name: "idevicesyslog"
section: "1"
platform: "linux"
package: "libimobiledevice"
version: "1.4.0-2"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/idevicesyslog"
---

# idevicesyslog(1)

Relay syslog of a connected device.

## NAME

idevicesyslog - Relay syslog of a connected device.

## SYNOPSIS

**idevicesyslog** \[OPTIONS\]

## DESCRIPTION

Relay syslog of a connected device.

## OPTIONS

- **-u, --udid UDID**

  target specific device by UDID

- **-n, --network**

  connect to network device

- **-x, --exit**

  exit when device disconnects

- **-d, --debug**

  enable communication debugging

- **-h, --help**

  prints usage information

- **-v, --version**

  Prints version information.

- **--no-colors**

  disable colored output

- **-o, --output FILE**

  Write to FILE instead of stdout. This will disable writing colored output, but can be re-enabled with **--colors**. If FILE already exists, it will be overwritten without warning.

- **--colors**

  Force writing colored output, e.g. when using **--output**.

- **--syslog-relay**

  Use old syslog\_relay service instead of os\_trace\_relay (iOS 9+).

## COMMANDS

- **pidlist**

  Print a list with PID and name of all processes currently running on the device.

- **archive PATH**

  Request a logarchive from the device. It will be written in tar format to PATH. To pipe to another process use - as PATH. Below are some options to restrict the log message data.

  In order to view the logarchive in a compatible log viewer, you can pipe the output data to **tar** and have it extract into a new directory:

  **mkdir test.logarchive && tools/idevicesyslog archive - \|tar -C test.logarchive -xv**

  This will also print the filenames while they are extracted.

- Further options for **archive**:

  - **--start-time VALUE**

  Start time of the log data as UNIX timestamp. Earlier messages will be dropped.

- **--age-limit VALUE**

  Maximum age of the log data, supposedly number of days.

- **--size-limit VALUE**

  Limit the size of the archive. The unit is currently unknown, so feel free to experiment.

- Keep in mind that the device usually only has a backlog of a few minutes so the options might not have the desired effect. This is not a bug.

  ## FILTER OPTIONS

- **-m, --match STRING**

  only print messages that contain STRING

- **-M, --unmatch STRING**

  print messages that do not contain STRING

- **-t, --trigger STRING**

  start logging when matching STRING

  When specified, logging will start as soon as a log messages is encountered that contains the given string. See also **-T, --untrigger**. Other filters are still applied but obviously filtered messages are only printed after logging has started.

- **-T, --untrigger STRING**

  stop logging when matching STRING

  When specified logging will halt as soon as a log message is encountered that contains the given string. See also **-t, --trigger**. Other filters are still applied but obviously filtered messages are only printed before logging stops.

  NOTE: If no **--trigger** is given, idevicesyslog will exit after a matching log message was encountered.

- **-p, --process PROCESS**

  only print messages from matching process(es)

  PROCESS is a string that can either be a numeric pid or a process name. It also supports multiple process names or pids in one string, separated by \| (make sure to use quotes!).

- **-e, --exclude PROCESS**

  print all messages except matching process(es)

  PROCESS is a string that can either be a numeric pid or a process name. It also supports multiple process names or pids in one string, separated by \| (make sure to use quotes!).

- **-q, --quiet**

  set a filter to exclude common noisy processes

  Since the syslog can be quite noisy, this quick command line switch allows silencing a predefined set of commonly known processes. The list of processes that are silenced can be retrieved with **--quiet-list**.

- **--quiet-list**

  prints the list of processes for **--quiet** and exits

- **-k, --kernel**

  only print kernel messages

  This is actually equivalent to passing **--process kernel** with the exception that it can be used with **--quiet** to silence out the noisy process but still get all the kernel log messages.

- **-K, --no-kernel**

  suppress kernel messages

  This is equivalent to passing **--exclude kernel**.

## EXAMPLES

- **idevicesyslog -u 00008030-0000111ABC000DEF**

  Relay syslog of device with UDID 00008030-0000111ABC000DEF.

- **idevicesyslog -x**

  Relay syslog of device and exit when the device is unplugged.

- **idevicesyslog -m '####' -e 'identityservicesd' -K**

  Only print log messages that contain the string #### and do NOT originate from identityservicesd or the kernel.

- **idevicesyslog -p MyApp -p ReportCrash**

  Only print log messages from the process named 'MyApp' and 'ReportCrash'.

- **idevicesyslog -p 'MyApp\|ReportCrash'**

  Same as previous example with different syntax.

- **idevicesyslog -e 'backboardd\|CommCenter\|mDNSResponder'**

  Suppress log messages from backboardd, CommCenter, and mDNSResponder.

- **idevicesyslog -q -k**

  Suppress log messages from common noisy processes, but DO print kernel log messages.

- **idevicesyslog -K**

  Suppress log messages from kernel, but print everything else

- **idevicesyslog -t 'backlight on' -T 'backlight off' -q**

  Start logging when the device turns on backlight and stop logging when it turns backlight off, and suppress noisy processes

## AUTHORS

Nikias Bassen, Martin Szulecki

Man page written to conform with Debian by Julien Lavergne.

## ON THE WEB

https://libimobiledevice.org

https://github.com/libimobiledevice/libimobiledevice