Free course

macOS Internals and Troubleshooting Course

Understand macOS processes, filesystems, metadata, services, logs, memory, networking, and recovery tools through evidence-based troubleshooting labs.

5 modules · 25 lessons · No signup

Prerequisites: macOS Basics, Shell Commands and macOS for Developers

~~~

Your progress

of lessons completed.

Course completed.

What you'll learn

Trace a Mac problem to its first failing boundary, collect useful evidence, repair the cause safely, and leave a repeatable diagnostic record.

Take this course offline

Subscribe to my newsletter to get every free book and course in PDF and EPUB format.

Get the downloads

Course contents

  1. Map the system

    Connect Darwin, the kernel, processes, launchd, hardware architecture, and APFS volumes into one system model.

    1. ✓ Separate macOS, Darwin, and the kernel
    2. ✓ Read the process tree
    3. ✓ Understand launchd domains
    4. ✓ Map APFS volumes and mounts
    5. ✓ Check your understanding: map the system

  2. Inspect files and applications

    Read permissions, ACLs, extended attributes, app bundles, property lists, Library folders, and quarantine state.

    1. ✓ Read mode, ACLs, and flags
    2. ✓ Inspect extended attributes
    3. ✓ Open an application bundle
    4. ✓ Trace Library state by scope
    5. ✓ Check your understanding: inspect files and applications

  3. Diagnose processes and resources

    Inspect process ancestry, open files, CPU, memory pressure, disk activity, hangs, crashes, and resource limits.

    1. ✓ Identify the real process
    2. ✓ Measure CPU and a hang
    3. ✓ Interpret memory pressure
    4. ✓ Trace disk activity, files, and crashes
    5. ✓ Check your understanding: diagnose processes and resources

  4. Trace services, logs, and network

    Query launchd, unified logs, listeners, routes, DNS state, and connection paths without destroying evidence.

    1. ✓ Query unified logs narrowly
    2. ✓ Connect launchd state to logs
    3. ✓ Inspect listeners and connections
    4. ✓ Trace route, DNS, and path
    5. ✓ Check your understanding: trace services, logs, and network

  5. Recover from failures

    Isolate scope, compare user and system state, use safe startup and recovery tools, verify repairs, and document the incident.

    1. ✓ Define scope before changing state
    2. ✓ Compare another user and safe mode
    3. ✓ Use recovery tools with a purpose
    4. ✓ Write and verify the diagnostic record
    5. ✓ Check your understanding: recover from failures