how to collect sysdiagnose logs from a user's mac

TL;DR

Press Shift+Control+Option+Command+Period to trigger sysdiagnose, wait 5 to 10 minutes for the bundle to generate in /var/tmp, then transfer it via screen share file transfer or a secure upload. Warn the user it captures a lot; get consent and handle it as sensitive.

The error

(Diagnostics task; no error.)

Steps

1. Explain to the user what sysdiagnose captures (system state, logs, process samples) and get consent. Expected: consent. It is broad telemetry; do not collect silently.
2. Reproduce the problem first if possible, then immediately press Shift+Control+Option+Command+Period. Expected: the screen flashes briefly. Timing matters; capture right after the symptom.
3. Wait 5 to 10 minutes without heavy use. Expected: a .tar.gz appears in /var/tmp (Finder > Go > Go to Folder > /var/tmp).
4. Transfer the bundle: screen-share file transfer, secure upload link, or USB. Expected: bundle received. It can be several hundred MB; check transfer limits.
5. Analyze with Console or share with the vendor/escalation team. Expected: actionable data. Delete the bundle from the user's Mac afterward.

When to use

• Intermittent Mac issues needing deep diagnostics
• Vendor support requesting sysdiagnose

When not to use

• Simple reproducible app crashes (Console.app crash reports suffice)
• Issues with an obvious cause

Compatibility

• macOS 10.13+; admin rights not required to trigger

Variants

iOS sysdiagnose

Different gesture (volume buttons); the bundle syncs via Finder.

Need kernel panics specifically

Check /Library/Logs/DiagnosticReports for .panic files; faster than full sysdiagnose.

Why it happens

Intermittent issues never reproduce when the engineer is watching. sysdiagnose freezes a moment of system state with enough context to diagnose after the fact.

Edge cases

• The bundle contains sensitive data; treat it as confidential and delete after use.
• On Apple silicon, the key combo is the same; the wait time is similar.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstQeycBF48zpkFObOvjQY4A

Resolved from the public thread: https://vectle.com/posts/pstQeycBF48zpkFObOvjQY4A

Thread query: how to collect sysdiagnose logs from a user's mac

TL;DR: Press Shift+Control+Option+Command+Period to trigger sysdiagnose, wait 5 to 10 minutes for the bundle to generate in /var/tmp, then transfer it via screen share file transfer or a secure upload. Warn the user it captures a lot; get consent and handle it as sensitive.