How to view a log file on a Mac
You can do this with Note My, and here is how to open a log, switch the colouring on, and know exactly what the colours are telling you about four thousand identical-looking lines.
A log file is the least helpful readable file on your Mac. Nothing is wrong with it — it is plain text, it opens, it scrolls. The trouble is that four thousand lines look identical, so finding the one that matters means reading all of them. What you want is for the failures to stand out, the timestamps to get out of the way, and the status codes to answer "did this work?" from a metre away.
This guide covers opening a log in Note My — including the ones macOS refuses to call text — turning the colouring on, and exactly what the colours pick out, so you can trust what they show you and go straight to the line that matters.
All of this happens on your Mac: nothing is uploaded, there is no account, and the log never leaves the machine. That matters more than usual here, because production logs carry addresses, tokens and user identifiers.
Open the log file
-
Open it the ordinary way
Press ⌘O and choose the file, drag it from the Finder onto the tab bar, or right-click it in the Finder and choose Note My ▸ Open. Select several at once and each arrives in its own tab.
Logs are frequently very large. Our large-file engine takes those in its stride: the window stays usable while a long file arrives, so you can start reading before the end has landed. On a very large document a Large File badge appears in the status bar to tell you what you are holding.
…08114:02:11.048 203.0.113.7 GET /api/v2/sync 200 12 ms…08214:02:11.052 198.51.100.23 GET /api/v2/state 200 9 ms…08314:02:11.201 203.0.113.7 POST /api/v2/commit 201 44 ms…084WARN queue depth rising — 1 208 pending…08514:02:12.114 192.0.2.41 GET /api/v2/manifest 500 310 ms…08614:02:12.119 203.0.113.7 GET /api/v2/sync 200 11 ms…08714:02:12.500 198.51.100.23 GET /healthz 200 2 msChars 326 004 118 Lines 2 004 111 ↵ LF Aa UTF-8 Plain TextA 326-million-character log, open and idle. The Large File badge is the editor telling you it has shifted into its heavy-lifting mode — it is display-only, and there is nothing to click. -
If macOS says it is not a text file, force it
Press ⇧⌘O for File ▸ Open Anything as Text…. This is the one to reach for with a rotated log called
access.log.1, a file with no extension at all, or an extension the system has handed to something else. Note My will not take those files over: it opens them when you ask, and never makes itself their default. -
Turn the colouring on
Choose View ▸ Enable Log Highlighting, or click the Log pill in the status bar. Either toggles it, and the colouring applies to the whole document immediately.
This is a separate switch from the colouring you get on source code, so you can have either one on its own. Logs follow shared conventions rather than a language, and those shared conventions are what the colours pick out, so there is something useful on screen the moment the file lands.
What the colouring actually looks for
Our syntax engine picks out six kinds of thing, and between them they carry most of the meaning in a log — the table below is what each one looks like on screen. It works the moment you switch it on, with nothing to set up first, so a format you have never opened is coloured usefully the first time you see it.
| What is coloured | Which text it covers | Colour |
|---|---|---|
| Severity keywords | FATAL, CRITICAL, SEVERE, ERROR, WARNING, WARN, NOTICE, INFO, DEBUG, TRACE, VERBOSE — whole words, any case | One per level band |
| ISO-8601 timestamps | 2026-09-02T14:02:11Z and the space-separated form, with or without fractional seconds and an offset | Deliberately muted |
| HTTP status codes | A three-digit number from 100 to 599 that is not part of a longer number | 2xx green · 3xx teal · 4xx orange · 5xx red |
| IPv4 addresses | Four dot-separated groups of one to three digits | Purple |
| UUIDs | The standard 8-4-4-4-12 hexadecimal form | Indigo |
| URLs | http://, https:// and file://, up to the next space or quote | Link colour |
Severity does most of the work
The eleven keywords collapse into six colour bands: FATAL, CRITICAL and SEVERE share one, because they mean the same thing in different logging libraries; ERROR, NOTICE and INFO each have their own; WARN and WARNING share one; DEBUG, TRACE and VERBOSE share the last. Case makes no difference to what you see: error, Error and ERROR all light up. A keyword sitting inside a longer word stays plain, so errors in the middle of an English sentence is left alone and your eye keeps going.
How to read the status colours
A bare three-digit number in the 100–599 range takes the status colour for its band. In an access log that is exactly right: a page of requests becomes something you can read at a glance, and a red flash halfway down the column is the line you wanted. Longer numbers, such as byte counts and epoch timestamps, stay in plain text, so a large response size never masquerades as a failure.
Timestamps are kept quiet on purpose
Timestamps are de-emphasised rather than highlighted. They are structural, not semantic: every line has one, so colouring them brightly would be pure noise. Dimming them lets your eye run down the column that actually differs. Addresses and UUIDs get quiet distinct colours for the opposite reason — you are usually hunting one specific value, and a colour makes it findable without a search.
Colour is never written into your file
This is worth being certain about before you open a production log. The colour changes what you see, never what is saved. Nothing about the bytes on disk changes, the tab is not marked as edited, and there is nothing to undo. Turn it off and the file is exactly what it was. The same holds for the syntax colouring used on code, and for soft wrap, invisible-character markers and the ruler style: every one of them affects your view and leaves the file alone.
When two colours could apply
Some text could plausibly belong to more than one of the six. What you get is the reading that makes sense to a human, and two cases are worth knowing:
- In
192.168.1.200the final group is a three-digit number in the status range, but the whole address is coloured purple as one thing. Addresses read as addresses. - A URL containing an address or an identifier takes the link colour along its full length, rather than breaking into differently coloured fragments.
Moving around a long log
Colour tells you where to look. These get you there.
- Jump to the next failure with ⌥⌘E, the previous one with ⌥⇧⌘E. They stop on
FATAL,CRITICAL,SEVERE,ERROR,WARNINGandWARNin any case, and wrap round at the end of the file. A brief heads-up display reports "Jumped to line N." - Go to a line number with ⌘L. The field is pre-filled with the line you are on, selected, so it also answers "where am I?". A number past the end of the log is refused outright rather than quietly landing you somewhere near it.
- Count what you found. Search first, then Search ▸ Count Matches, which reports "N matches on M lines." Two numbers rather than one, so you can tell a problem spread across the log from one piled on a few lines.
- Collect the interesting lines. Search for a request ID, press ⌥⌘B for Bookmark All Search Matches, then use Copy Bookmarked Lines to lift just those lines out. F2 and ⇧F2 step between bookmarks.
If the log is still being written, View ▸ Follow Tail pins the view to the end of the file and adds new lines as they land, so you can watch a deploy or a test run without touching the scroll bar. The colouring applies to those lines like any other text, so a red 5xx arriving at the bottom of the window catches your eye. Like the other view settings, it writes nothing to the file.
Putting the colours to work
With the colouring on, a log stops being a wall of text and becomes a document you can move around in. Four things it is particularly good for.
- Triage an access log in a single pass. Scroll with your eye on the status column rather than on the words. The 2xx greens and 3xx teals settle into a calm band you can skim past at speed, and the orange and red are the requests actually worth reading. When one stops you, ⌘L tells you which line you are on, so you can jot the number down and carry on scrolling.
- Watch a deploy or a test run as it happens. Switch on View ▸ Follow Tail and leave the window open on a second screen. New lines arrive already coloured, so a red 5xx or a FATAL announces itself from across the desk while you are getting on with something else, and you can jump back the moment one appears.
- Lift one request out of the noise. Indigo makes the first UUID easy to spot and copy. Search for it, press ⌥⌘B to bookmark every match, then use Copy Bookmarked Lines. What you get back is that single request's story as a short block of text, ready to paste into a ticket or an email without the four thousand lines around it.
- Work through a stack trace in order. The severity keyword at the head of a traceback is what your eye lands on first. From there ⌥⌘E carries you to the next failure and ⌥⇧⌘E back to the one before, so you can walk the incident from beginning to end rather than hunting for where it started.
When you have a run that worked and a run that did not, open both logs and use the toolbar Compare menu — Quick Compare pairs them straight away when they are the only two open. Our comparison view marks the differing lines in place across both panes, and the point where the two accounts stop agreeing is usually the point where the trouble began. If either file is enormous, our large-file engine keeps the window responsive while you read it, so the size of a log is never the thing that decides how you work.
All of this happens to your view of the log rather than to the log itself. Colour it, bookmark half of it, jump around it for an hour: not a byte changes on disk, and the tab is never marked as edited. That is what makes it comfortable to do on a production log you have been handed and are expected to give back exactly as it came.
Troubleshooting
Nothing changed colour
Check that View ▸ Enable Log Highlighting is on — it is a toggle, not a one-shot command. If you would rather work from the status bar, the pills are governed by a setting that is on by default, so switch it back on and the Log pill returns; the menu item works either way. Then look at how your log writes its levels. One that abbreviates them to [E] and [W] is using markers of its own, and our find and replace will find every one of them for you: search with a regular expression, press ⌥⌘B to bookmark every match, then step down the file with F2. Each marked line takes a dot in the gutter, so the places where the trouble clusters stay visible as you scroll, and it works on any marker you care to name.
A number is coloured that I did not expect
Colour follows the convention rather than the column, and that is what makes a log you have never opened before readable at first sight, with nothing to configure and no format to describe first: any bare three-digit number in the 100–599 range takes the colour of its band, whether it is a status code, a port or a duration in milliseconds. To settle which column you are reading, search for the field beside it — every occurrence lights up at once, and ⌥⌘B bookmarks them all, so you can walk down the file one match at a time with F2 and read the shape of the line for yourself. Once you know that shape, the colours carry you the rest of the way, and the same reading holds for every log written in the same format.
The characters are garbled
Stray accents, or a  before every non-ASCII character, mean the file was opened with the wrong encoding. Use File ▸ Encoding ▸ Reload with Encoding… and pick the one the file was written in. Our encoding handling shows you the same file again in the right characters and leaves the file alone, so you can try another if the first is wrong. Convert to Encoding… is the opposite operation — it changes what will be written — so do not reach for it here.
The log keeps changing while I read it
When a file changes outside the app while it is open, you are offered Reload or Keep My Version, so an edit of yours is never lost. In the default Ask mode there is one exception, and it is the one you want here. A file ending in .log or .out that you have not edited refreshes quietly instead of interrupting you. That applies to the extension only — a notes.txt with "log" in its name still asks.
Spell-check underlines appear under the log
Those red and green underlines are macOS's own spelling and grammar marks, offered over any plain text, and a log gives them plenty to object to. They are marks on your view and nothing more: no character in the file has been touched. Nothing that rewrites text is ever switched on here either — automatic correction, smart quotes, dash substitution and data detection are all off, so a stack trace, a token or a path is never silently reworded behind your back.
Frequently asked questions
Does turning on log highlighting modify my log file?
Your log comes through untouched. The colour is part of your view, not part of the file: the bytes on disk stay as they were, the tab is not marked as edited, and there is nothing to undo. Switch the colouring off and you are looking at the same file you opened.
Can I open a log with no extension, or one ending in .1?
Yes. Use ⇧⌘O for File ▸ Open Anything as Text…, which forces open a file macOS does not classify as text. The colouring works the same once it is open, whatever the file is called.
Why are my timestamps grey instead of coloured?
That is deliberate. Timestamps appear on every line, so they say nothing about which line matters. They are muted so the parts that do differ stand out.
Does the colouring apply to lines that arrive while I am following a file?
Yes. New lines are coloured as they arrive, like any other text, so a red 5xx at the foot of the window is hard to miss. Following a file and colouring it are separate switches, and most people who use one use both.
How do I find every error in a large log without scrolling?
Use ⌥⌘E and ⌥⇧⌘E. They stop on FATAL, CRITICAL, SEVERE, ERROR, WARNING and WARN in any case, and wrap round at the end of the file, so a few presses take you through every failure in a log of any length. For a marker of your own, search for it with a regular expression, bookmark all the matches and step between them with F2.
How do I open Find and Replace on a log?
Click the magnifying-glass button in the toolbar. That opens our find and replace, which takes regular expressions and pairs with ⌥⌘B to bookmark every match at once. ⌘F gives you the system find bar, which is a quicker way to check a single word.