What is sysdiagnose?

sysdiagnose is a diagnostic tool built into macOS. You might see it running after you trigger a system diagnostic.

What is sysdiagnose?

It gathers a full snapshot of your Mac's state for troubleshooting. It collects logs, system settings, running processes, network state, disk data, and more, then packs it all into one archive. Apple Support sometimes asks you to run it when tracking down a hard problem.

What does it collect?

A sysdiagnose archive holds:

• System logs and crash reports
• Running process list and resource use
• Network settings and active connections
• Disk and file system data
• Power and battery data
• Installed software and extensions
• Spindump and other performance snapshots
• System setup details

How do you run it?

You can start sysdiagnose in two ways:

• Press Shift + Control + Option + Command + Period (this works anywhere)
• Run it from the terminal:

sudo sysdiagnose

The archive is saved to /var/tmp/ and Finder opens the folder when it finishes.

What about sysdiagnose_helper?

sysdiagnose_helper is the privileged helper that collects data needing root access: kernel state, system-level logs, and hardware data that a normal process cannot reach.

Does it use many resources?

Yes, for a short time. Building a full archive takes a minute or two and uses noticeable processor time and disk activity. This is normal.

Should you worry?

No. sysdiagnose only runs when you (or Apple Support) start it yourself. The resulting archive can be large (several hundred megabytes), so check its contents before sending it to anyone. It holds detailed system data.

Enjoyed this post?

Well, you could share the post with others, follow me with RSS Feeds and/or send me a comment via email.

Tags