aslmanager

Apple System Log data life-cycle manager

aslmanager [-s store_dir] [-a [archive_dir]] [-ttl days] [-store_ttl days]
          [-module_ttl days] [-size max_size] [-asldb]
          [-module [name]] [-checkpoint] [-d [level]] [-dd [level]]

Started by syslogd or admin, manages rotation of files and ASL data written by syslogd .
Configuration /etc/asl.conf, /etc/asl which may be overridden by command-line options .

Checks the ASL database in store_path (/var/log/asl), then files and directories specified by /etc/asl.conf and each ASL output module.

-asldb only ASL database will be processed.
-module [module] ASL database will not be processed. All ASL output modules, or a single module if name is specified, will be processed.
-checkpoint [module] signal syslogd to checkpoint files for all modules, or for a single named module, before processing.
-d 1|2|3 output debug messages, 3 causing the most detail.. default: 1.
-dd 1|2|3 dry run ,no modifications are made
-s file use file for store_path.
-size bytes max size of the entire database
Causes archival and removal files to keep the database size below the specified limit. Default : 150 MB.
Files are removed in order starting from oldest to newest. Files with the same date are removed in standard lexicographic order.
-store_ttl days days (time_to_live) to retain files.
Files older than time-to-live are archived or removed.
Files that contain messages with explicit expire times are removed or archived monthly after all their contents expire.
Default 7 days, zero causes file NOT to be deleted. (bad idea)
-a [dir]Files are removed or copied to an archive directory.
With no argument, files are copied to /var/log/asl.archive .
Use the archive parameter in asl.conf with "1" to enable archiving, or "0" to disable . An archive directory path may follow the flag.

ASL OUTPUT MODULE MANAGEMENT

-module modname aslmanager first locates all For each ASL output module, or a single module specified as an argument following Checks ASL data stores and rotated log files i.e. those with rotate in the module's configuration rules.
  • Checkpoint files are renamed as per style.
  • Compress the file if directed by compress and
  • Moves the file to a destination directory if dest is specified for the file. Deletes expired files. The time-to-live for files is 7 days by default, overide with ttl for the file in the module's configuration rules.
    Command line,overrides defalault:
    -module_ttl for module processing.
    -ttl for the ASL database and for modules.
  • Deletes files, oldest first until files do no exceed all_max size of all the rotated versions
    When processing ASL directory data stores, deletes data files after the expiry of their time-to-live, and will delete data files (oldest first) to limit the total size as specified by ``all_max''. 

ls -l /etc/asl.conf
-rw-r--r--  1 root  wheel  1051 Mar 10 04:15 asl.conf
> cat /etc/asl.conf
##
# configuration file for syslogd and aslmanager
##

# aslmanager logs
> /var/log/asl/Logs/aslmanager external style=lcl-b ttl=2

# authpriv messages are root/admin readable
? [= Facility authpriv] access 0 80

# remoteauth critical, alert, and emergency messages are root/admin readable
? [= Facility remoteauth] [<= Level critical] access 0 80

# Broadcast emergency messages
? [= Level emergency] broadcast

# Store kernel [PID 0] and launchd [PID 1] messages
? [<= PID 1] store

# Ignore "internal" facility
? [= Facility internal] ignore

# Store everything from emergency,alert, error, warning, notice i.e. 0,1,2,3,4,5 <= 5
? [<= Level notice] store

# Rules for /var/log/system.log                                                 ##############
> system.log mode=0640 format=bsd rotate=seq compress file_max=5M all_max=50M
? [= Sender kernel]                     file system.log
? [<= Level notice]                     file system.log
? [= Facility auth]     [<= Level info] file system.log
? [= Facility authpriv] [<= Level info] file system.log

# Facility com.apple.alf.logging gets saved in appfirewall.log
? [= Facility com.apple.alf.logging] file appfirewall.log file_max=5M all_max=50M

See

asl, asl.conf, syslogd(8), syslog, syslog(3).