Interface Guide
Understanding the IntuneLogWatch three-pane interface and navigation
IntuneLogWatch uses a three-pane interface designed to provide a logical flow from high-level sync events down to detailed log analysis.
The left pane displays chronological events with key information at a glance.
IntuneLogWatch reads the log file and can show you Sync Events and Recurring Events, or both in a combined timeline.
Click the picker or use the keyboard to filter the events view. (Your selection is remembered in user defaults and used the next time you launch IntuneLogWatch)
Command Key Filtering:
- Command + 1 = Sync Events
- Command + 2 = Recurring Events
- Command + 3 = Health Events
You can also choose to sort the event list in ascending (Command + Up Arrow ) or descending (Command + Down Arrow) evert order.
Also available is information about the Enrollment Status and the Network Connectivity.
Each sync event shows:
-
Status Icon: Visual indicator for success ✅, failure ❌, warning
⚠️ , or in-progress 🔄 - Timestamp: When the sync occurred
- Policy Count: Total number of policies processed in this sync
- Duration: How long the sync took to complete
- Error Indicators: Number of failed or warning policies (if any)
- Successful Syncs: All policies completed without issues
- Failed Syncs: One or more policies encountered errors
- Warning Syncs: Policies completed with warnings or minor issues
- In-Progress: Syncs currently running (live monitoring)
The center pane shows all policies that were processed during the selectwed sync event.
- Actual Icons: Real application icons for installed apps
- System Icons: Generic icons for system policies and scripts
- Fallback Icons: Default icons when app icons aren't available
- Policy Names: Application names or script descriptions
- Status Badges: Individual policy completion status
- Type Indicators: Visual bubbles showing policy characteristics
Visual indicators for quick identification:
- App Type: PKG or DMG installations
- Script Type: SCRIPT or ATTR (attribute scripts)
- Intent: Required, Available, or Uninstall
- Context: Root or User execution context for scripts
- ✅ Success: Policy completed successfully
- ❌ Failed: Policy encountered an error
-
⚠️ Warning: Policy completed with warnings - 🔄 Running: Policy currently executing
The right pane provides detailed information about the selected policy, with two viewing modes.
- Chronological Entries: Log entries in time order
- Visual Timeline: Left sidebar showing time progression
- Event Correlation: Related log entries grouped visually
- Status Highlights: Important events highlighted with colors
- Original Format: Logs exactly as written by Intune
- Technical Details: Full log messages with timestamps
- Search Capability: Find specific text within log entries
- Copy Function: Select and copy specific log lines
- Copy Icon: Click to copy Policy ID (GUID) to clipboard
-
Right Click: Contextual Menu with additional options
- Copy Policy ID (Same as the click option)
- Copy Graph API URL
- Copy Intune Portal URL
- Open Intune Portal URL
-
Clickable Policy ID: Click to be taken directly to the policy in the Intune console.
-
Reveal in Finder: Available for App installations. -
Inspect PKG Receipt: Available for App policies installed via PKG. -
Export Event to PDF: Export this event to a PDF. -
Export Event to Log: Export this event to a Log file. -
View Entry Details: View or copy the event details. -
Clip Event to Library: Click to save the even to your Clip Library.
** Any buttons that are Grayed out are unavailable action items for the current policy.
When errors are detected in policies, they are highlighted with additional context.
- Red Text: Error messages and failure indicators
- Warning Highlights: Warnings and potential issues
- Info Symbols: Clickable icons for additional details
- Root Cause: Why the policy failed
- Recommendations: Suggested solutions or next steps
- Related Logs: Connected log entries that provide context
Click once anywhere on the drawer to reveal the quick action buttons. Mouse away from the drawer and it will automatically close.
- Intune Logs: Open the Intune logs folder located here: '/Library/Logs/Microsoft/Intune/'
- Clip Library: Open the Clip Library window
- Error Codes: Open the Error Codes Reference window
- Wiki: Open the IntuneLogWatch main wiki page on GitHub
- Release Notes: Open the IntuneLogWatch release note page on GitHub
- Graph Explorer: Open the Microsoft Graph Explorer page to lookup or manage policies
Choose the appearance of the IntuneLogWatcher application. The default appearance is "System" where the application look defaults to the current system setting.
You will find this setting on the View menu. View -> Appearance ->
Choose "Light" or "Dark" to override the default appearance.
- ⌘O: Open log file
- ⌘R: Reload local logs
- ⌘F: Search within current view
- Arrow Keys: Navigate between policies and events
- Click: Select sync events or policies
- Double-Click: Open detailed view for log entries
- Right-Click: Context menu with copy and export options
- Scroll: Navigate through long lists and detailed logs
- Multiple Tabs: Open different log files in separate tabs
- Tab Labels: Show source (filename or "Local Intune Logs")
- Tab Switching: ⌘1, ⌘2, etc. to switch between tabs
Double-click any log entry to view complete details in a modal window.
- Full Message: Complete multi-line log messages
- Timestamp: Exact time of log entry
- Log Level: Error, Warning, Info, Debug levels
- Copy Function: Copy specific entries for support tickets
- Context: Related log entries before and after
Now includes a Quick Look Extension to preview content of .ilwclip files. These are the files you create when saving a log event to your Clip Library.
This is an easy way to preview the content of the file before importing, or launching the IntuneLogWatch application.
- ← Back to Installation & Setup
- Next: Features & Analysis →
Need help understanding a specific interface element? Check our Troubleshooting guide or ask on GitHub Issues.