Must they exist?? com.apple.MessageTracer # redirect com.apple.message.domain to /var/log/DiagnosticMessages ? [T com.apple.message.domain] claim only * store_dir /var/log/DiagnosticMessages ttl=30 com.apple.authd ? [= Sender authd] claim only * file /var/log/authd.log mode=0640 compress format=bsd rotate=seq file_max=5M all_max=20M ? [<= Level error] file /var/log/system.log ? [<= Level error] store com.apple.cdscheduler # /etc/asl/com.apple.cdscheduler > cdscheduler.log format=std rotate=local ttl=3 all_max=2M compress ? [= Sender com.apple.CDScheduler] file cdscheduler.log ? [= Sender com.apple.CDScheduler] [> Level error] claim com.apple.contacts.ContactsAutocomplete > /var/log/com.apple.contacts.ContactsAutocomplete mode=0750 ? [= Facility com.apple.contacts.ContactsAutocomplete] claim only ? [= Facility com.apple.contacts.ContactsAutocomplete] [= Category Debug] file /var/log/com.apple.contacts.ContactsAutocomplete/Debug.log rotate=Debug.local.log ttl=7 file_max=10M all_max=200M compress fmt='$(Time) $(Host) $(Sender)[$(PID) $(ThreadID)] <$((Level)(str))>: $(Function):$(Line) | $(Message)' ? [= Facility com.apple.contacts.ContactsAutocomplete] [= Category Performance] file /var/log/com.apple.contacts.ContactsAutocomplete/Performance.log rotate=Performance.local.log ttl=7 file_max=10M all_max=200M compress fmt='$(Time) $(Host $(Sender)[$(PID) $(ThreadID)] <$((Level)(str))>: $(Function):$(Line) | $(Message)' ? [= Facility com.apple.contacts.ContactsAutocomplete] [= Category Sorting] file /var/log/com.apple.contacts.ContactsAutocomplete/Sorting.log rotate=Sorting.local.log ttl=7 file_max=10M all_max=200M compress fmt='$(Time) $(Host) $(Sender)[$(PID) $(ThreadID)] <$((Level)(str))>: $(Function):$(Line) | $(Message)' ? [= Facility com.apple.contacts.ContactsAutocomplete] [= Category Probes] file /var/log/com.apple.contacts.ContactsAutocomplete/Probes.log rotate=Probes.local.log ttl=7 file_max=10M all_max=200M compress fmt='$(Time) $(Host) $(Sender)[$(PID) $(ThreadID)] <$((Level)(str))>: $(Function):$(Line) | $(Message)' com.apple.coreduetd # Even though coreduetd currently does not use ASL, this tells ASLmanager to rotate the log file # daily by copying it, compressing it, and then truncating the existing file. # It will also delete files older than 1 day old. > /var/log/CoreDuet/coreduetd.log extern rotate=local extern rotate=local compress truncate mode=0644 ttl=1 all_max=16M com.apple.eventmonitor # redirect com.apple.eventmonitor* messages to /var/log/eventmonitor ? [A= Facility com.apple.eventmonitor] claim only * store_dir /var/log/eventmonitor com.apple.install # install messages get saved only in /var/log/install.log ? [= Facility install] claim only * file /var/log/install.log format='$((Time)(JZ)) $Host $(Sender)[$(PID)] $Message' rotate=seq compress file_max=50M all_max=150M size_only com.apple.iokit.power ? [= Facility com.apple.iokit.power] claim only * store_dir /var/log/powermanagement rotate=local ttl=14 # Guest logs are admin readable and copied to limited-duration Guest.log # This module is only enabled when user "Guest" is logged in. = enable 0 = [= ut_user Guest] [= ut_type 7] enable 1 = [= ut_user Guest] [= ut_type 8] enable 0 ? [= UID 201] access 0 80 ? [= UID 201] file /Users/Guest/Library/Logs/Guest.log soft com.apple.mail # mail facility has its own log file ? [= Facility mail] claim only > /var/log/mail.log mode=0644 format=bsd rotate=seq compress file_max=5M all_max=50M * file /var/log/mail.log com.apple.mkb > /private/var/log/keybagd.log soft compress format=bsd rotate=seq file_max=5M all_max=20M ttl=5 ? [= Sender keybagd] claim file keybagd.log ? [= Sender kernel] [CA= Message AppleKeyStore] file keybagd.log ? [= Sender UserEventAgent] [CS= Message LockStateNotifier] file keybagd.log ? [= Sender kernel] [CA= Message AppleSEPKeyStore] file keybagd.log com.apple.mkb.internal = enable [File /private/var/root/.mkb_debug] com.apple.mkb.internal > /private/var/log/keybagd.log ? [= Sender kernel] [CA= Message SEP] file keybagd.log ? [= Sender SpringBoard] [CS= Message MC ] file keybagd.log ? [= Sender SpringBoard] [CS= Message secure lock screen] file keybagd.log ? [= Sender backboardd] [CA= Message MultitouchHID] file keybagd.log ? [= Sender profiled] file keybagd.log ? [= Sender mdmd] file keybagd.log com.apple.networking.boringssl = enable [Plist /Library/Preferences/com.apple.networkd.plist] [= boringssl_log_debug 1] ? [= Facility com.apple.networking.boringssl] file /Library/Logs/CrashReporter/com.apple.networking.boringssl.log rotate=local-basic crashlog file_max=1M compress format=$((Time)(local.6))\ $Host\ $(Sender)[$(PID)]\ <$((Level)(str))> \ $(Message) > /Library/Logs/CrashReporter mode=0755 com.apple.performance # redirect com.apple.performance* messages to /var/log/performance ? [A= Facility com.apple.performance] claim only * store_dir /var/log/performance com.apple.MessageTracer com.apple.authd com.apple.cdscheduler com.apple.contacts.ContactsAutocomplete com.apple.coreduetd com.apple.eventmonitor com.apple.install com.apple.iokit.power com.apple.login.guest com.apple.mail com.apple.mkb com.apple.mkb.internal com.apple.networking.eapol com.apple.networking.boringssl com.apple.performanceASL config "claims" syslog