Log network device sessions and search them later

Every SSH and console session can leave a plain-text record. Here is where it goes, what is in it and how to find one line in months of output.

Checked against SheepTerm for Mac 5.0 (20) and SheepTerm for Windows 0.1 (8), 2026-10.

It is on by default

SheepTerm writes every SSH and serial session to its own plain-text file. The toggle is File › Log Sessions to File; it is on unless you turn it off. File › Open Logs Folder opens the folder in Finder.

Where: ~/Documents/SheepTerm Logs/ on the Mac.
File names: the session name, the start date and time, and a short suffix, for example core-sw1 2026-10-14 091203-a1b2.log.
Which sessions: SSH and serial. Local shell tabs and web tabs are not logged.

What goes into a log

Everything the device sends to the screen, as text. Colour and cursor-control sequences are removed, and so are other control characters apart from tab and line feed, so the file reads like the screen and opens cleanly in any editor.
Because it records what the device sends, a password you type at a prompt that does not echo is not in the file. Anything the device does echo is, so treat logs of configuration output as sensitive.
A log stops at 100 MB per session and ends with a --- log truncated at 100 MB --- line.
Highlighting colours are drawn over the screen only. They are never part of the log.

Naming from the prompt. When a session is named after an IP address or a console cable, SheepTerm renames the open log and the tab once it has seen the device’s prompt a couple of times, giving Core-SW (cu.usbserial-1420) ….log. Sessions you named yourself keep their name.

Skip one session. Turn on “Don’t log this session” in New SSH Connection, New Serial Console or Edit Host. It is saved with the host.

Find something across every log

Choose File › Search Logs… (⇧⌘F) and type what you are after: a MAC address, an interface, an error string. Results are grouped by log file, newest first, with the line numbers that matched. Double-click a line to open the log. Regex and Match case switches are beside the search field, and Reveal in Finder shows the selected file.

The Search Logs window finding a MAC address in two session logs, with sample data — Illustration with sample data: searching all logs for the end of a MAC address.

Practical tips

Name hosts clearly. Hosts you name yourself give you log files you can recognise later.
Mind where Documents lives. On a Mac that syncs Desktop and Documents to iCloud, the logs sync with it. If that is not what you want for device output, turn logging off per host or clear the folder regularly.
Back up before you delete. Logs are ordinary files; SheepTerm never uploads them. Sync (if you turn it on) carries hosts and settings, not logs.

On Windows

The menu entries have the same names: Log Sessions to File (on by default), Open Logs Folder and Search Logs… (Ctrl+Alt+F). Logs are stored in the Data\Logs folder beside SheepTerm.exe, because the Windows app is portable.

Get SheepTerm

Download for macOS Download for Windows

Free. Mac: macOS 26.4 or later, Apple Silicon, not notarized (right-click, Open on first launch). Windows: 10/11 x64, portable zip, unsigned (SmartScreen may warn).