add example log commands

Author: drduh

README.md

@@ -1370,7 +1370,7 @@ sudo lsof -Pni TCP:22
 
 Do not leave the computer unattended in unsafe locations. A skilled attacker with unsupervised physical access could install a [hardware keylogger](https://trmm.net/Thunderstrike_31c3) to record keystrokes, including passwords. Using a Mac with a built-in keyboard or a bluetooth keyboard makes this more difficult as many off-the-shelf versions of this attack are designed to be plugged in between a USB keyboard and the computer.
 
-To reduce the consequences of theft while a Mac is in use, consider a theft-response tool such as [buskill/buskill-app](https://github.com/buskill/buskill-app) or [Lennolium/swiftGuard](https://github.com/Lennolium/swiftGuard).
+To reduce the consequences of theft while a Mac is in use, consider using [buskill/buskill-app](https://github.com/buskill/buskill-app) or [Lennolium/swiftGuard](https://github.com/Lennolium/swiftGuard).
 
 Consider purchasing a privacy screen/filter for use in public.
 
@@ -1380,15 +1380,57 @@ Consider purchasing a privacy screen/filter for use in public.
 
 ## Logs
 
-Monitor system logs with [Console](https://support.apple.com/guide/console/toc) or the `/usr/bin/log stream` command.
+Monitor system logs with [Console](https://support.apple.com/guide/console/toc) or the `log stream` command.
 
-To show log entries generated by the `audioaccessoryd` process during the last hour:
+Print all system logs from the last 5 minutes in classic syslog format:
 
 ```bash
-/usr/bin/log show \
-  --last 1h \
-  --predicate 'process == "audioaccessoryd"' \
-  --style compact
+log show --last 5m --style syslog
+```
+
+Output as JSON array:
+
+```bash
+log show --last 5m --style json
+```
+
+Output newline-delimited JSON (one JSON object per line); required for [jq](https://jqlang.org/download/):
+
+```bash
+log show --last 5m --style ndjson
+```
+
+Filter messages by subsystem, for example from `com.apple.SoftwareUpdate`:
+
+```bash
+log show --last 1h --style json \
+  --predicate 'subsystem == "com.apple.SoftwareUpdate"'
+```
+
+Filter messages by content, for example containing `failed`:
+
+```bash
+log show --last 1h --predicate 'eventMessage CONTAINS "failed"'
+```
+
+Case-insensitive message filtering:
+
+```bash
+log show --last 1h --predicate 'eventMessage CONTAINS[c] "error"'
+```
+
+Count distinct error messages with jq:
+
+```bash
+log show --last 1h --style ndjson \
+  --predicate 'eventMessage CONTAINS[c] "error"' |
+  jq -r '.eventMessage' | sort | uniq -c | sort -nr | head -100
+```
+
+Export logs to an archive, which can be opened with Console:
+
+```bash
+log collect --last 1h --output ~/Downloads/logs-$(date +%F-%H%M).logarchive
 ```
 
 ## DTrace