Sign in Subscribe
tips

OS X's Native 5-finger, 5-minute System Diagnosis

Jacob Salmela

• 2 min read

Quickly gather a ton of system information on any Mac with a five-key keyboard shortcut!

Control-Option-Command-Shift-Period

After triggering the keyboard shortcut, it may look like nothing happened (on Yosemite, the screen briefly flashes white), but if you open up /var/tmp , you will see a sysdiagnose folder (it won’t actually finish until the folder is transformed into a .tar.gz, which can take a couple of minutes).

A great deal of information is harvested, spanning system state and configuration.  Much of the information is very low-level and aimed at developers, but there are a lot of useful pieces of information that regular users can parse through (in bold):

  • A spindump of the system
  • Several seconds of fs_usage
  • Several seconds of top
  • Data about kernel zones
  • Status of loaded kernel extensions
  • Resident memory usage of user processes
  • All system logs, kernel logs, opendirectory log, windowserver log, and log of power management events
  • A System Profiler report
  • All spin and crash reports
  • Disk usage information
  • I/O Kit registry information
  • Network status
  • If a specific process is supplied as an argument: list of malloc-allocated buffers in the process’s heap is collected
  • If a specific process is supplied as an argument: data about unreferenced malloc buffers in the process’s memory is collected
  • If a specific process is supplied as an argument: data about the virtual memory regions allocated in the process

To make this information a little bit more readable–and more portable–Apple has another nice utility buried within the Feedback Assistant that came with the OS X Yosemite Beta.  It doesn’t look like it is included in the final release, though.

[UPDATE]: It looks like the script now lives in /usr/libexec/feedback/

Apple used this when a beta tester submitted feedback through the app, but if you can get your hands on the script, you can make sysdiagnose  more readable.  Certain pieces of information can be easily extracted, too, such as CPU or memory usage.

Run systriage.rb -h to see the options available.  Then you just need to provide a path to your zipped sysdiagnose file (the .tar.gz created in /var/tmp ).  The output of the systriage.rb script is a lot easier to read:

**********************************************************************
Hardware and Software Version (from system_profiler.spx)
**********************************************************************
  OS Version | 10.9.4 (Build 13E28)
     Machine | MacBookAir6,2
        Disk | Solid State
         RAM | 4 GB

**********************************************************************
Machine State (see top.txt for raw data)
**********************************************************************
Used: 2837M Free: 17M
The system is not currently paging.
Read from disk 1367 times for 22M
Wrote to disk 152 times for 2149K
Received from network 29 times for 2444B
Sent to network 32 times for 2991B

**********************************************************************
CPU Usage (see top.txt and spindump.txt for raw data)
Run `systriage -c path` for more information.
**********************************************************************
     CPU      PID COMMAND          |    IDLEW      PID COMMAND          |  
    6.11        0 kernel_task      |      122        0 kernel_task      |     6.01     8253 Google Chrome   

    5.71     8253 Google Chrome    |        7     8253 Google Chrome    |     4.76      273 parentalcontrols
    4.76      273 parentalcontrols |        6    39619 Adobe Photoshop  |     3.06      120 WindowServer    
    2.99      120 WindowServer     |        6    40339 SophosManagement |     2.83     8266 Google Chrome He
    2.83     8266 Google Chrome He |        6      106 SophosMessageRou |     2.60    24510 Terminal

Now go and gather some useful troubleshooting information from your users!

Sign up for more like this.

Enter your email
Subscribe