Troubleshoot: Copy Agent Logs in macOS Recovery Mode

This article outlines how to gather JumpCloud Agent logs from a macOS device in Recovery Mode. This may be required if the user is locked out of the device and only Recovery Mode is accessible.

You'll need an external USB storage device like a flash drive or external hard drive. Without an external drive, you won't be able to copy the log files off of the device's internal storage.

To copy agent logs in macOS Recovery Mode:

1. Boot the device into Recovery Mode. See Apple’s Intro to macOS Recovery.
2. Launch Disk Utility from the menu options and then mount the Macintosh – Data volume.
   • If the disk has FileVault enabled you’ll be prompted to unlock it.
3. Quit Disk Utility.
4. In the top menu bar select Utilities > Terminal.
5. Enter the following command in Terminal to display the names of all the mounted volumes: ls /Volumes
   • You can find the name of your external USB drive here. Ensure you remember the name or write it down as you’ll need this for step 8 to copy the log files off to the drive.  
6. To change into the directory holding the logs, type in the following into terminal: cd /Volumes/Macintosh\ HD\ -\ Data/private/var/log
7. Then display all of the files under this folder by typing in the following into terminal: ls
8. Copy the log files by entering the following command: cp jcagent.log /Volumes/YOURDRIVENAME
9. Check that the file successfully copied by typing: ls /Volumes/YOURDRIVENAME

You can then review the jcagent.log for any issues or submit the jcagent.log and a description to our JumpCloud Support Team to help triage the cause of the lockout or other issues.