as of El Captain 3/4/16:
/etc/asl > g claim *
| com.apple.AccountPolicyHelper: | ? [= Facility com.apple.AccountPolicyHelper] claim only |
| com.apple.Accounts: | ? [= Facility com.apple.Accounts.file] claim |
| com.apple.Accounts: | ? [= Facility com.apple.Accounts.lite] claim |
| com.apple.CoreDuetAdmissionControl: | ? [C= Facility com.apple.CoreDuetAdmission] claim only |
| com.apple.MessageTracer: | ? [T com.apple.message.domain] claim only |
| com.apple.authd: | ? [= Sender authd] claim only |
| com.apple.authkit.osx.asl: | ? [= Facility com.apple.authkit.log.file] claim |
| com.apple.authkit.osx.asl: | ? [= Facility com.apple.authkit.traffic.log.file] claim |
| com.apple.awdd: | # We claim all messages at Error or below. This means ASL only sees Alert messages. |
| com.apple.awdd: | ? [= Sender com.apple.awdd] [> Level alert] claim |
| com.apple.callhistory.asl.conf: | # We claim all messages at Error or below. This means ASL only sees Alert messages. |
| com.apple.callhistory.asl.conf: | ? [= Sender com.apple.callhistory] [> Level alert] claim |
| com.apple.cdscheduler: | ? [= Sender com.apple.CDScheduler] [> Level error] claim |
| com.apple.cloudd: | # We claim all messages at Error or below. This means ASL only sees Error messages, which is good: cloudkit doesn't |
| com.apple.cloudd: | ? [= Facility com.apple.cloudkit] [> Level error] claim |
| com.apple.clouddocs: | ? [A= Facility com.apple.clouddocs] [> Level error] claim |
| com.apple.commerce.asl: | ? [= Facility com.apple.commerce] claim only |
| com.apple.contacts.ContactsAutocomplete: | ? [= Facility com.apple.contacts.ContactsAutocomplete] claim only |
| com.apple.corecdp.osx.asl: | ? [= Facility com.apple.corecdp.log.file] claim |
| com.apple.corespotlight: | ? [= Facility com.apple.corespotlight] claim only |
| com.apple.eventmonitor: | ? [A= Facility com.apple.eventmonitor] claim only |
| com.apple.family.asl: | ? [= Facility com.apple.family.log.file] claim only |
| com.apple.ical: | ? [= Facility com.apple.ical] claim only |
| com.apple.icloud.FindMyDevice: | ? [A= Facility com.apple.icloud.FindMyDevice.asl] claim |
| com.apple.icloud.FindMyDevice: | ? [A= Facility com.apple.icloud.FindMyDevice.UserAgent.asl] claim |
| com.apple.icloud.fmfd: | ? [A= Facility com.apple.icloud.fmfd.asl] claim |
| com.apple.icloud.fmfd: | ? [A= Facility com.apple.icloud.fmf.framework.asl] claim |
| com.apple.icloud.fmfd: | ? [A= Facility com.apple.icloud.fmfui.framework.asl] claim |
| com.apple.install: | ? [= Facility install] claim only |
| com.apple.iokit.power: | ? [= Facility com.apple.iokit.power] claim only |
| com.apple.mail: | ? [= Facility mail] claim only |
| com.apple.mobileme.fmf1: | ? [A= Facility com.apple.mobileme.fmf1.asl] claim |
| com.apple.mobileme.fmf1.internal: | ? [A= Facility com.apple.mobileme.fmf1.asl] claim |
| com.apple.networking.symptoms: | # We claim all messages at Error or below. This means ASL only sees Error messages. |
| com.apple.networking.symptoms: | ? [= Facility com.apple.networking.symptomevaluator] [> Level error] claim |
| com.apple.networking.symptoms: | ? [= Facility com.apple.networking.symptomanalytics] [> Level error] claim |
| com.apple.networking.symptoms: | ? [= Facility com.apple.networking.symptomsdhelper] [> Level error] claim |
| com.apple.performance: | ? [A= Facility com.apple.performance] claim only |
| com.apple.secinitd: | ? [= Sender secinitd] [= Level debug] claim |
| com.apple.securityd: | # processing our messages. We claim anything short |
| com.apple.securityd: | ? [T SecAPITrace] [> Level error] claim |
| com.apple.securityd: | ? [= Sender com.apple.securityd] [> Level error] claim |
| com.apple.securityd: | ? [= Sender com.apple.secd] [> Level error] claim |
| com.apple.securityd: | ? [= Sender CloudKeychainProxy] [> Level error] claim |
| com.apple.securityd: | ? [= Sender IDSKeychainSyncingProxy] [> Level error] claim |
| com.apple.securityd: | ? [= Sender securityd] [> Level error] claim |
| com.apple.securityd: | ? [= Sender secd] [> Level error] claim |
| com.apple.securityd: | ? [= Sender securityd_service] [> Level error] claim |
| com.apple.xpc.activity: | ? [= Sender com.apple.cts] [> Level error] claim |
| com.apple.xpc.activity: | ? [= Sender com.apple.xpc.activity] [> Level error] claim |
> security.log format='$Time $(Sender)[$(PID)] <$((Level)(str))> [$(Facility){$(SecAPITrace)} $(CALLER)]: $Message' rotate=utc-basic +crashlog compress file_max=5M all_max=20M
# Note: this file is for OSX only.
# Note:
# securityd is the iOS securityd
# com.apple.securityd is the OSX securityd
# com.apple.secd is the iOS version of securityd running on OSX
? [T SecAPITrace] file security.log
? [= Sender com.apple.securityd] file security.log
? [= Sender com.apple.secd] file security.log
? [= Sender CloudKeychainProxy] file security.log
? [= Sender IDSKeychainSyncingProxy] file security.log
? [= Sender securityd] file security.log
? [= Sender secd] file security.log
? [= Sender securityd_service] file security.log
# Claim prevents the built-in ASL configuration from
# processing our messages. We claim anything short
# of errors, and let ASL do what it wants with the rest
? [T SecAPITrace] [> Level error] claim
? [= Sender com.apple.securityd] [> Level error] claim
? [= Sender com.apple.secd] [> Level error] claim
? [= Sender CloudKeychainProxy] [> Level error] claim
? [= Sender IDSKeychainSyncingProxy] [> Level error] claim
? [= Sender securityd] [> Level error] claim
? [= Sender secd] [> Level error] claim
? [= Sender securityd_service] [> Level error] claim