What is logd on Mac?

What logd does

logd (/usr/libexec/logd, running as root) is the unified logging daemon introduced in macOS Sierra. Processes don’t write log files themselves; they send messages through os_log, and logd collects, compresses and stores them in /var/db/diagnostics. Console.app and the log command read from there. Separate helpers (diagnosticd, logd_helper) handle live streaming and some housekeeping.

Why it uses CPU or disk

• A chatty process: an app or daemon stuck in an error loop, logging the same failure many times a second.
• Debug logging left on: a configuration profile installed for troubleshooting (Apple’s Bluetooth or Wi-Fi logging profiles, for example) or a developer tool that enabled verbose logs.
• A log stream session at debug level, left running in a terminal.
• Crash loops: a service that keeps crashing generates crash logs and log messages on every restart (see launchd).

How to find the noisy process

Count messages per process over the last minute:

/usr/bin/log show --last 1m --style compact | awk '$1 ~ /^20/ {print $4}' | cut -d'[' -f1 | sort | uniq -c | sort -rn | head

(Use the full path /usr/bin/log: in zsh, the default Mac shell, plain log is a built-in command that does something else.)

The top line is your culprit. Look at what it’s saying:

/usr/bin/log show --last 1m --predicate 'process == "NoisyThing"' --style compact | tail -20

Check how much space the log takes:

sudo du -sh /var/db/diagnostics

How to make it calm down

1. Update, reconfigure or remove the noisy app. Error loops are often a sign of an expired login or a missing permission in that app.
2. Remove leftover logging profiles in System Settings › General › Device Management.
3. Check whether a subsystem has had its level raised:

sudo log config --status

4. Close any log stream sessions you’ve forgotten about.
5. Restart: a crash-looping service often settles after a reboot.

If the log has grown huge, sudo log erase --all clears it. You lose history that’s useful for troubleshooting, so only do it when space really matters.

When to worry

logd is Apple’s and protected by System Integrity Protection. Confirm with:

codesign -dv --verbose=2 /usr/libexec/logd 2>&1 | grep Authority

Sustained heavy logging matters for two reasons: it wastes battery, and on a nearly full SSD it adds avoidable writes. Neither is dangerous in the short term, but a process that logs nonstop is broken and worth fixing.

Seeing it in Stat Space

Stat Space’s Disk tab shows read and write speed and top apps by I/O, with NVMe SMART data (wear, TB written) alongside. If logd is near the top of the I/O list every day, you’ll see it there, and the TB-written figure tells you whether it actually matters for your SSD.