Troubleshoot macOS 13 Fleets: Top Diagnostic Tools

Managing and troubleshooting a macOS 13 (Ventura) fleet requires robust diagnostic and reporting mechanisms to identify performance bottlenecks, software crashes, and configuration drift. This article outlines the primary built-in utilities, command-line frameworks, and enterprise reporting solutions system administrators use to extract diagnostic telemetry, isolate device failures, and maintain endpoint health across an enterprise network.

1. sysdiagnose

The sysdiagnose tool is Apple’s most comprehensive diagnostic utility. It collects system-wide state information, including kernel logs, process lists, disk usage, power management data, and network configurations.

  • Usage: Administrators can trigger it locally via keyboard shortcuts (Control-Option-Command-Shift-Period) or remotely via the Terminal using sudo sysdiagnose -f /path/to/save/.
  • Output: Generates a compressed .tar.gz archive containing full diagnostic dumps, which can be gathered remotely via script execution and analyzed to solve complex system lockups and kernel panics.

2. Apple Unified Logging (log CLI)

Introduced to replace traditional syslog and system logs, the Unified Logging System centralizes memory and disk-based events from apps and the OS itself.

  • Stream and Capture: The log stream command displays real-time events, while log show retrieves historical activity.
  • Filtering: Admins can target specific subsystems and categories using predicates (e.g., log show --predicate 'subsystem == "com.apple.TimeMachine"' --info --last 1h).
  • Enterprise Application: Useful for diagnosing authentication failures, configuration profile enforcement errors, and launch daemon issues across endpoints.

3. System Information CLI (system_profiler)

To audit hardware, installed extensions, and system configurations across thousands of devices, admins leverage system_profiler.

  • Usage: Running system_profiler -json or system_profiler -xml outputs the complete system topology into structured data.
  • Fleet Reporting: Admins frequently pipe this output into fleet management platforms or shell-based extension attributes to capture battery cycle counts, SIP (System Integrity Protection) status, and pending software updates.

4. DiagnosticReports (/Library/Logs/DiagnosticReports)

macOS 13 automatically writes process crash, hang, and panic reports to the file system as .ips or .crash files.

  • Access: Located at /Library/Logs/DiagnosticReports for system-level issues and ~/Library/Logs/DiagnosticReports for user-space application failures.
  • Analysis: These JSON-formatted text files capture the exact thread that crashed, the termination reason, and backtraces, allowing administrators to verify if an issue stems from internal enterprise software or macOS system binaries.

5. Declarative Device Management (DDM)

macOS 13 significantly expanded support for Declarative Device Management through modern Mobile Device Management (MDM) platforms (e.g., Jamf Pro, Kandji, Mosyle).

  • Autonomous Status Reporting: Instead of servers repeatedly polling endpoints, DDM allows devices to proactively inform the MDM server when specific states change—such as OS version, passcode compliance, or profile installation status.
  • Proactive Fleet Monitoring: Enables administrators to receive real-time alerts when devices fall out of compliance or fail policy enforcement.

6. osquery and the Endpoint Security Framework

For large-scale telemetry and endpoint visibility, administrators deploy osquery alongside Apple’s native Endpoint Security API (ESF).

  • osquery: Exposes macOS low-level internals as a relational database, allowing admins to write SQL queries that pull information about active network sockets, running daemons, unauthorized kernel extensions, and local user configurations.
  • Endpoint Security: Provides high-performance, real-time event streaming for process execution, file integrity monitoring, and authorization hooks to pinpoint rogue software behavior across the fleet.