Apple ASL apple system log module

syslog -module

 syslog -module
ASL out module: com.apple.asl [current status: enabled]
  output       /var/log/appfirewall.log
    rules: 1
    dest: (none)
    format: std
    time_format: lcl
    flags: 0x00004008 (coalesce)
    ttl: 7 days
    mode: 0644
    file_max: 5242880
    all_max: 52428800
    uid: 0
    gid: 80
  output       /var/log/system.log
    rules: 4
    dest: (none)
    format: bsd
    time_format: lcl
    flags: 0x0000401c (rotate coalesce compress)
        rotatation style: [base=system].[ext=log].
    ttl: 7 days
    mode: 0640
    file_max: 5242880
    all_max: 52428800
    uid: 0
    gid: 80
  output       /var/log/asl
    rules: 2
    dest: (none)
    format: std
    time_format: lcl
    flags: 0x00002000 (asl_directory)
    ttl: 7 days
    mode: 0755
    file_max: 0
    all_max: 0
    uid:
    gid:
  output       /var/log/asl/Logs/aslmanager
    rules: 0
    dest: (none)
    format: std
    time_format: lcl
    flags: 0x0000404c (rotate coalesce external)
        rotatation style: [base=aslmanager].
    ttl: 2 days
    mode: 010000
    file_max: 0
    all_max: 0
    uid:
    gid:
  access        Q [= Facility authpriv] 0 80
  access        Q [= Facility remoteauth] [<= Level 2] 0 80
  broadcast     Q [= Level 0]
  store         Q [<= PID 1]
  ignore        Q [= Facility internal]
  store         Q [<= Level 5]
  file          Q [= Sender kernel] system.log
  file          Q [<= Level 5] system.log
  file          Q [= Facility auth] [<= Level 6] system.log
  file          Q [= Facility authpriv] [<= Level 6] system.log
  file          Q [= Facility com.apple.alf.logging] appfirewall.log file_max=5M all_max=50M

ASL out module: com.apple.mkb.internal [current status: disabled]
  output       /private/var/log/keybagd.log
    rules: 6
    dest: (none)
    format: std
    time_format: lcl
    flags: 0x00004028 (coalesce non-std_dir)
    ttl: 7 days
    mode: 0644
    file_max: 0
    all_max: 0
    uid: 0
    gid: 80
  set (file)    Q [. /private/var/root/.mkb_debug] enable
  file          Q [= Sender kernel] [CA= Message SEP] keybagd.log
  file          Q [= Sender SpringBoard] [CSZ= Message MC:] keybagd.log
  file          Q [= Sender SpringBoard] [CSZ= Message secure lock screen] keybagd.log
  file          Q [= Sender backboardd] [CA= Message MultitouchHID] keybagd.log
  file          Q [= Sender profiled] keybagd.log
  file          Q [= Sender mdmd] keybagd.log

ASL out module: com.apple.cdscheduler [current status: enabled]
  output       /var/log/module/com.apple.cdscheduler/cdscheduler.log
    rules: 1
    dest: (none)
    format: std
    time_format: lcl
    flags: 0x0000401c (rotate coalesce compress)
        rotatation style: [base=cdscheduler].[ext=log].
    ttl: 3 days
    mode: 0644
    file_max: 2097152
    all_max: 2097152
    uid: 0
    gid: 80
  file          Q [= Sender com.apple.CDScheduler] cdscheduler.log
  claim         Q [= Sender com.apple.CDScheduler] [> Level 3]

ASL out module: com.apple.install [current status: enabled]
  output       /var/log/install.log
    rules: 1
    dest: (none)
    format: $((Time)(JZ)) $Host $(Sender)[$(PID)]: $Message
    time_format: lcl
    flags: 0x00008014 (rotate compress size_only)
        rotatation style: [base=install].[ext=log].
    ttl: 7 days
    mode: 0644
    file_max: 52428800
    all_max: 157286400
    uid: 0
    gid: 80
  claim         Q [= Facility install] only
  file          Q [. ] /var/log/install.log format='$((Time)(JZ)) $Host $(Sender)[$(PID)]: $Message' rotate=seq compress file_max=50M all_max=150M size_only

ASL out module: com.apple.authd [current status: enabled]
  output       /var/log/asl
    rules: 1
    dest: (none)
    format: std
    time_format: lcl
    flags: 0x00002000 (asl_directory)
    ttl: 7 days
    mode: 0755
    file_max: 0
    all_max: 0
    uid:
    gid:
  output       /var/log/system.log
    rules: 1
    dest: (none)
    format: std
    time_format: lcl
    flags: 0x00004008 (coalesce)
    ttl: 7 days
    mode: 0644
    file_max: 0
    all_max: 0
    uid: 0
    gid: 80
  output       /var/log/authd.log
    rules: 1
    dest: (none)
    format: bsd
    time_format: lcl
    flags: 0x0000401c (rotate coalesce compress)
        rotatation style: [base=authd].[ext=log].
    ttl: 7 days
    mode: 0640
    file_max: 5242880
    all_max: 20971520
    uid: 0
    gid: 80
  claim         Q [= Sender authd] only
  file          Q [. ] /var/log/authd.log mode=0640 compress format=bsd rotate=seq file_max=5M all_max=20M
  file          Q [<= Level 3] /var/log/system.log
  store         Q [<= Level 3]

ASL out module: com.apple.eventmonitor [current status: enabled]
  output       /var/log/eventmonitor
    rules: 1
    dest: (none)
    format: std
    time_format: lcl
    flags: 0x00006000 (asl_directory)
    ttl: 7 days
    mode: 0755
    file_max: 0
    all_max: 0
    uid: 0
    gid: 80
  claim         Q [A= Facility com.apple.eventmonitor] only
  asl_dir       Q [. ] /var/log/eventmonitor

ASL out module: com.apple.coreduetd [current status: enabled]
  output       /var/log/CoreDuet/coreduetd.log
    rules: 0
    dest: (none)
    format: std
    time_format: lcl
    flags: 0x000040dc (rotate coalesce compress external)
        rotatation style: [base=coreduetd].[ext=log].
    ttl: 1 day
    mode: 0644
    file_max: 16777216
    all_max: 16777216
    uid:
    gid:

ASL out module: com.apple.mail [current status: enabled]
  output       /var/log/mail.log
    rules: 1
    dest: (none)
    format: bsd
    time_format: lcl
    flags: 0x0000401c (rotate coalesce compress)
        rotatation style: [base=mail].[ext=log].
    ttl: 7 days
    mode: 0644
    file_max: 5242880
    all_max: 52428800
    uid: 0
    gid: 80
  claim         Q [= Facility mail] only
  file          Q [. ] /var/log/mail.log

ASL out module: com.apple.login.guest [current status: disabled]
  output       /Users/Guest/Library/Logs/Guest.log
    rules: 1
    dest: (none)
    format: std
    time_format: lcl
    flags: 0x00004828 (soft coalesce non-std_dir)
    ttl: 7 days
    mode: 0644
    file_max: 0
    all_max: 0
    uid: 0
    gid: 80
  set           enable 0
  set           Q [= ut_user Guest] [= ut_type 7] enable 1
  set           Q [= ut_user Guest] [= ut_type 8] enable 0
  access        Q [= UID 201] 0 80
  file          Q [= UID 201] /Users/Guest/Library/Logs/Guest.log soft

ASL out module: com.apple.performance [current status: enabled]
  output       /var/log/performance
    rules: 1
    dest: (none)
    format: std
    time_format: lcl
    flags: 0x00006000 (asl_directory)
    ttl: 7 days
    mode: 0755
    file_max: 0
    all_max: 0
    uid: 0
    gid: 80
  claim         Q [A= Facility com.apple.performance] only
  asl_dir       Q [. ] /var/log/performance

ASL out module: com.apple.iokit.power [current status: enabled]
  output       /var/log/powermanagement
    rules: 1
    dest: (none)
    format: std
    time_format: lcl
    flags: 0x00006000 (asl_directory)
    ttl: 14 days
    mode: 0755
    file_max: 0
    all_max: 0
    uid: 0
    gid: 80
  claim         Q [= Facility com.apple.iokit.power] only
  asl_dir       Q [. ] /var/log/powermanagement rotate=local ttl=14

ASL out module: com.apple.contacts.ContactsAutocomplete [current status: enabled]
  output       /var/log/com.apple.contacts.ContactsAutocomplete/Probes.log
    rules: 1
    dest: (none)
    format: $(Time) $(Host) $(Sender)[$(PID):$(ThreadID)] <$((Level)(str))>: $(Function):$(Line) | $(Message)
    time_format: lcl
    flags: 0x00000014 (rotate compress)
        rotatation style: [base=Probes]..[ext=log]
    ttl: 7 days
    mode: 0644
    file_max: 10485760
    all_max: 209715200
    uid: 0
    gid: 80
  output       /var/log/com.apple.contacts.ContactsAutocomplete/Sorting.log
    rules: 1
    dest: (none)
    format: $(Time) $(Host) $(Sender)[$(PID):$(ThreadID)] <$((Level)(str))>: $(Function):$(Line) | $(Message)
    time_format: lcl
    flags: 0x00000014 (rotate compress)
        rotatation style: [base=Sorting]..[ext=log]
    ttl: 7 days
    mode: 0644
    file_max: 10485760
    all_max: 209715200
    uid: 0
    gid: 80
  output       /var/log/com.apple.contacts.ContactsAutocomplete/Performance.log
    rules: 1
    dest: (none)
    format: $(Time) $(Host) $(Sender)[$(PID):$(ThreadID)] <$((Level)(str))>: $(Function):$(Line) | $(Message)
    time_format: lcl
    flags: 0x00000014 (rotate compress)
        rotatation style: [base=Performance]..[ext=log]
    ttl: 7 days
    mode: 0644
    file_max: 10485760
    all_max: 209715200
    uid: 0
    gid: 80
  output       /var/log/com.apple.contacts.ContactsAutocomplete/Debug.log
    rules: 1
    dest: (none)
    format: $(Time) $(Host) $(Sender)[$(PID):$(ThreadID)] <$((Level)(str))>: $(Function):$(Line) | $(Message)
    time_format: lcl
    flags: 0x00000014 (rotate compress)
        rotatation style: [base=Debug]..[ext=log]
    ttl: 7 days
    mode: 0644
    file_max: 10485760
    all_max: 209715200
    uid: 0
    gid: 80
  output       /var/log/com.apple.contacts.ContactsAutocomplete
    rules: 0
    dest: (none)
    format: std
    time_format: lcl
    flags: 0x00004008 (coalesce)
    ttl: 7 days
    mode: 0750
    file_max: 0
    all_max: 0
    uid:
    gid:
  claim         Q [= Facility com.apple.contacts.ContactsAutocomplete] only
  file          Q [= Facility com.apple.contacts.ContactsAutocomplete] [= Category Debug] /var/log/com.apple.contacts.ContactsAutocomplete/Debug.log rotate=Debug.local.log ttl=7 file_max=10M all_max=200M compress fmt='$(Time) $(Host) $(Sender)[$(PID):$(ThreadID)] <$((Level)(str))>: $(Function):$(Line) | $(Message)'
  file          Q [= Facility com.apple.contacts.ContactsAutocomplete] [= Category Performance] /var/log/com.apple.contacts.ContactsAutocomplete/Performance.log rotate=Performance.local.log ttl=7 file_max=10M all_max=200M compress fmt='$(Time) $(Host) $(Sender)[$(PID):$(ThreadID)] <$((Level)(str))>: $(Function):$(Line) | $(Message)'
  file          Q [= Facility com.apple.contacts.ContactsAutocomplete] [= Category Sorting] /var/log/com.apple.contacts.ContactsAutocomplete/Sorting.log rotate=Sorting.local.log ttl=7 file_max=10M all_max=200M compress fmt='$(Time) $(Host) $(Sender)[$(PID):$(ThreadID)] <$((Level)(str))>: $(Function):$(Line) | $(Message)'
  file          Q [= Facility com.apple.contacts.ContactsAutocomplete] [= Category Probes] /var/log/com.apple.contacts.ContactsAutocomplete/Probes.log rotate=Probes.local.log ttl=7 file_max=10M all_max=200M compress fmt='$(Time) $(Host) $(Sender)[$(PID):$(ThreadID)] <$((Level)(str))>: $(Function):$(Line) | $(Message)'

ASL out module: com.apple.mkb [current status: enabled]
  output       /private/var/log/keybagd.log
    rules: 3
    dest: (none)
    format: bsd
    time_format: lcl
    flags: 0x0000483c (soft rotate coalesce compress non-std_dir)
        rotatation style: [base=keybagd].[ext=log].
    ttl: 5 days
    mode: 0644
    file_max: 5242880
    all_max: 20971520
    uid: 0
    gid: 80
  claim         Q [= Sender keybagd] file keybagd.log
  file          Q [= Sender kernel] [CA= Message AppleKeyStore] keybagd.log
  file          Q [= Sender UserEventAgent] [CSZ= Message LockStateNotifier] keybagd.log
  file          Q [= Sender kernel] [CA= Message AppleSEPKeyStore] keybagd.log

ASL out module: com.apple.MessageTracer [current status: enabled]
  output       /var/log/DiagnosticMessages
    rules: 1
    dest: (none)
    format: std
    time_format: lcl
    flags: 0x00006000 (asl_directory)
    ttl: 30 days
    mode: 0755
    file_max: 0
    all_max: 0
    uid: 0
    gid: 80
  claim         Q [T com.apple.message.domain] only
  asl_dir       Q [. ] /var/log/DiagnosticMessages ttl=30

ASL out module: com.apple.networking.boringssl [current status: disabled]
  output       /Library/Logs/CrashReporter
    rules: 0
    dest: (none)
    format: std
    time_format: lcl
    flags: 0x00004008 (coalesce)
    ttl: 7 days
    mode: 0755
    file_max: 0
    all_max: 0
    uid:
    gid:
  output       /Library/Logs/CrashReporter/com.apple.networking.boringssl.log
    rules: 1
    dest: (none)
    format: $((Time)(local.6)) $Host $(Sender)[$(PID)] <$((Level)(str))>: $(Message)
    time_format: lcl
    flags: 0x00000514 (rotate compress basestamp crashlog)
        rotatation style: [base=com.apple.networking.boringssl].[ext=log].
    ttl: 7 days
    mode: 0644
    file_max: 1048576
    all_max: 0
    uid: 0
    gid: 80
  set (plist)   Q [. /Library/Preferences/com.apple.networkd.plist] [= boringssl_log_debug 1] enable
  file          Q [= Facility com.apple.networking.boringssl] /Library/Logs/CrashReporter/com.apple.networking.boringssl.log rotate=local-basic crashlog file_max=1M compress format=$((Time)(local.6))\ $Host\ $(Sender)[$(PID)]\ <$((Level)(str))>:\ $(Message)