Apple Unified Logging - Apple Silicon and reboot causes

[daworley]

Hi Jamf Nation,

I'm working on a script to capture the most recent causes of a restart. This command works great on Intel Macs and provides useful data output:

log show --predicate 'eventMessage contains "Previous shutdown cause"' --last 24h

Does anybody know of the equivalent log predicate for Macs with Apple Silicon? In all of my testing on my lab M1 this command does not respond back with useful data, and I can't find the proper log predicate to give me what I need.

For context, this blog article brilliantly shows the response codes and probable causes for the restarts.

[mattbeef]

While i cant help with M1 mac's how are you viewing this info in the JSS?
I want to be able to set this as an attribute extension if possible but even if i grep the data i want i still get nothing after an inventory with my one liner

log show --predicate 'eventMessage contains "Previous shutdown cause"' --last 7d | grep "Previous shutdown cause:"

[ThijsX]

@daworley @mattbeef

Hi,

Maybe it is interesting to look at the following to gather your specific logs into Jamf Pro for in the Computer record.

About logCollection
Jamf Marketplace

[mattbeef]

Wow, i had no idea that this existed. Thanks so much. Looks like it will need some work for what the client wants but at least i can now get the logs from the machines now