V1 Interface Guide
Understanding the IntuneLogWatch three-pane interface and navigation
IntuneLogWatch uses a three-pane interface designed to provide a logical flow from high-level sync events down to detailed log analysis.
The left pane displays chronological events with key information at a glance.
IntuneLogWatch reads the log file and can show you Sync Events and Recurring Events, or both in a combined timeline.
Click the picker or use the keyboard to filter the events view. (Your selection is remembered in user defaults and used the next time you launch IntuneLogWatch)
Command Key Filtering:
- Command + 1 = All Events
- Command + 2 = Sync Events
- Command + 3 = Recurring Events
You can also choose to sort the event list in ascending or descending evert order.
Also available is information about the Enrollment Status and the Network Connectivity.
Each sync event shows:
-
Status Icon: Visual indicator for success ✅, failure ❌, warning
⚠️ , or in-progress 🔄 - Timestamp: When the sync occurred
- Policy Count: Total number of policies processed in this sync
- Duration: How long the sync took to complete
- Error Indicators: Number of failed or warning policies (if any)
- Successful Syncs: All policies completed without issues
- Failed Syncs: One or more policies encountered errors
- Warning Syncs: Policies completed with warnings or minor issues
- In-Progress: Syncs currently running (live monitoring)
The center pane shows all policies that were processed during the selected sync event.
- Actual Icons: Real application icons for installed apps
- System Icons: Generic icons for system policies and scripts
- Fallback Icons: Default icons when app icons aren't available
- Policy Names: Application names or script descriptions
- Status Badges: Individual policy completion status
- Type Indicators: Visual bubbles showing policy characteristics
Visual indicators for quick identification:
- App Type: PKG or DMG installations
- Script Type: SCRIPT or ATTR (attribute scripts)
- Intent: Required, Available, or Uninstall
- Context: Root or User execution context for scripts
- ✅ Success: Policy completed successfully
- ❌ Failed: Policy encountered an error
-
⚠️ Warning: Policy completed with warnings - 🔄 Running: Policy currently executing
The right pane provides detailed information about the selected policy, with two viewing modes.
- Chronological Entries: Log entries in time order
- Visual Timeline: Left sidebar showing time progression
- Event Correlation: Related log entries grouped visually
- Status Highlights: Important events highlighted with colors
- Original Format: Logs exactly as written by Intune
- Technical Details: Full log messages with timestamps
- Search Capability: Find specific text within log entries
- Copy Function: Select and copy specific log lines
- Copy Icon: Click to copy Policy ID (GUID) to clipboard
- Option+Click: Copy Graph Explorer URL for API access
- Control+Click: Copy Intune Portal URL for direct editing
When errors are detected in policies, they are highlighted with additional context.
- Red Text: Error messages and failure indicators
- Warning Highlights: Warnings and potential issues
- Info Symbols: Clickable icons for additional details
- Root Cause: Why the policy failed
- Recommendations: Suggested solutions or next steps
- Related Logs: Connected log entries that provide context
- ⌘O: Open log file
- ⌘R: Reload local logs
- ⌘F: Search within current view
- Arrow Keys: Navigate between policies and events
- Click: Select sync events or policies
- Double-Click: Open detailed view for log entries
- Right-Click: Context menu with copy and export options
- Scroll: Navigate through long lists and detailed logs
- Multiple Tabs: Open different log files in separate tabs
- Tab Labels: Show source (filename or "Local Intune Logs")
- Tab Switching: ⌘1, ⌘2, etc. to switch between tabs
Double-click any log entry to view complete details in a modal window.
- Full Message: Complete multi-line log messages
- Timestamp: Exact time of log entry
- Log Level: Error, Warning, Info, Debug levels
- Copy Function: Copy specific entries for support tickets
- Context: Related log entries before and after
- ← Back to Installation & Setup
- Next: Features & Analysis →
Need help understanding a specific interface element? Check our Troubleshooting guide or ask on GitHub Issues.