Where is the kprintf (kernel printf) log on Sierra?

Question

There are lots of pages that explain it but I can't find it. Many of the articles I find only work on El Capitan and older systems.

I cannot use the fwkpfv right now as I don't have the right dongles. My client is getting me a used MacBook that will support firewire.

My kernel extension panics my box. Quite oddly if my coworker builds my extension, it works just fine. I remain flummoxed.

Answer 1

You can get "live" local kernel logs using the command

log stream --process 0

For looking at past logs, use log show instead, e.g.:

log show --predicate 'processID == 0' --last 1h | less

None of that will help you much with kernel panics, however, as the logging happens asynchronously in user space, so you won't get the very last messages before the panic.

A few more options for debugging KPs without firewire, which you're probably already aware of but I'll mention them for completeness' sake:

• Ethernet-based kernel debugging (as opposed to firewire). Only the test device needs wired/thunderbolt ethernet, the Mac running the debugger can be on wifi.
• You can often extract quite a lot of info from the panic log itself: in addition to symbolicating the stack (use keepsyms=1 boot-arg so you don't have to do it retroactively), looking at the register contents and disassembly can often tell you the values of variables.
• If you're missing parts of Apple's code the stack trace, run a debug or development kernel instead of the release one. Those are built with fewer optimisations enabled, so functions are less likely to be inlined, etc.
• There are a bunch of memory debugging and other diagnostic options you can turn on in the kernel, e.g. -zp, -zc and so on.
• If you can repro the crash in a VM (VMWare Fusion, Parallels, VirtualBox, KVM/Qemu, whatever), you can use the VM's simulated serial port to log kprintf output. The virtual ethernet ports also tend to support kernel debugging if you set them up right.