| Mac OS version BusyBox version | linux unified logging |
syslog -s message … [-r host ] [-l level ]
syslog -s -k key value …
-s | send a message. Also done by logger |
-r host | remote syslog server (see syslog.conf) |
| set the log level (priority) of the message 1-7 or
A, alert …
Emergency† (0) note counter-intuitiveAccepts one or two leading characters for a level specification. Use Em for Emergency and Er for Error.
Examples: syslog -s -l Er "Cannot mount /dev/disk0s14"produces entry:(as displayed by kiwi )
syslog -s -r DaLogger@example.com -l Em -k Facility eq mail "sent trhough LAN -l Em"produces entry:(as displayed by kiwi )
|
-k key val |
structured message will be sent with keys and values as arguments.A key or value with embedded white space must be enclosed in quotes.
|
syslog [-w] [-F format] [-u] expression
With no arguments, syslog displays all the messages in the data store with level < INFO.
note counter-intuitive Error has a level less than info.
(i.e. notices, warnings, errors, criticals, alerts and emergencies ).
-w |
displays last 36 messages and waits for new messages, ( similar to watching a log file using:
tail -f /var/log/system.log
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-u | UTC is used to display time stamps | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-F format |
Custom format strings may include variables of the form syslog -F '$Time $Host $(Sender)[$(PID)]: $Message' produces output : May 26 01:43:51 smacker Software Update[19720]: __choice_su_visible returned wrong type (()) May 26 14:56:10 localhost mDNSResponder-108.5 (May 9 2007 15[-1]: 08:01)[63]: starting May 26 14:56:18 localhost DirectoryService[80]: Launched version 2.1 (v353.6) May 26 14:56:22 localhost mDNSResponder[-1]: Adding browse domain local. May 26 14:56:22 localhost configd[67]: WirelessConfigure: 88001003 May 26 14:56:22 localhost configd[67]: initCardWithStoredPrefs failed. May 26 14:56:22 localhost configd[67]: WirelessConfigure: 88001003
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-k | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Clients of the "System Log Facility" (using either the asl or syslog interfaces) have a log filter mask which specifies if messages should be sent for each priority level.
syslog -c process [mask] [-s [on|off]] [-t [on|off ]]
process | pid name0 (for master flags) |
| must be currently running |
> /usr/bin/syslog -c systemstats Process 208 syslog settings: 0x00000000 OFF / 0x00 Off
mask |
A value is set for the Master filter, overrides the local filter for all processes.
To display the setting of the Master filter mask:
> /usr/bin/syslog -c 0
Master settings: 0x00000000 OFF / 0x00 Off
> sudo /usr/bin/syslog -c 0 d -t on
> /usr/bin/syslog -c 0
Master settings: 0x00070080 ON ASL TRACE / 0x80 Debug
The master filter may be unset with:
sudo /usr/bin/syslog -c 0 offTo disable
Debug and Info messages , sudo /usr/bin/syslog -c 0 -dAnother filter mask is specified for an individual process. If a per-process filter mask is set, it overrides both the local filter mask and the master filter mask.
The default data store filter mask saves messages with priority levels from Emergency to Notice (level 0 to 5). The level may be inspected using:
syslog -c syslogdFor example, to save messages with priority level
Error or less in the data store:
syslog -c syslog -eErrors include:
syslog -configflags:
debug 0 dbtype file db_file_max 25600000 db_memory_max 256 db_memory_str_max 1024000 mps_limit 0 |
com.apple.asl enabled com.apple.AccountPolicyHelper enabled com.apple.applepushservice enabled com.apple.authd enabled com.apple.callhistory.asl.conf enabled com.apple.cdscheduler enabled com.apple.clouddocs enabled com.apple.install enabled com.apple.contacts.ContactsAutocomplete enabled com.apple.contacts.ContactsUICore enabled com.apple.coreaudio enabled com.apple.CoreDuetAdmissionControl enabled com.apple.coreduetd enabled com.apple.eventmonitor enabled com.apple.DuetHeuristic-BM enabled com.apple.DuetHeuristic-BM-OSX enabled |
syslog -module [name [enable 1|0] checkpoint [file]
with no name, outputs configuration for all ASL output modules
with name and no action, prints configuration for named ASL output module
supported actions - module name required, use '*' (with single quotes) for all modules:
˙ enables (or disables with 0) named module. does not apply to com.apple.asl when '*' is used
˙ checkpoints all files or specified file for named module
syslog -stats [-n n][ -d path] [-v]
outputs usage statistics
-n n | outputs stats for just the top n (e.g. top 10) senders |
-d path | reads the ASL database at the given path for statistics |
-v |
syslog [-f file …] [-d path … ] [-x file]
[-w [N]] [-F format] [-nocompress]
[-u] [-sort key1 [key2]] [-nsort key1
[key2]] [-k key [[op] val]]... [-o
-k key [[op] val]] …] …
-f read named file[s], rather than standard log message store.
-d read all file in named directory path, rather than standard log message store.
-x export to named ASL format file, rather than printing
-w watch data store (^C to quit)
prints the last N matching lines (default 10) before waiting
"-w all" prints all matching lines before waiting
"-w boot" prints all matching lines since last system boot before waiting
-F output format may be "std", "raw", "bsd", or "xml"
format may also be a string containing variables of the form
$Key or $(Key) - use the latter for non-whitespace delimited variables
-T timestamp format may be "sec" (seconds), "utc" (UTC), or "local" (local timezone)
-E text encoding may be "vis", "safe", or "none"
-nodc no duplicate message compression
-u print timestamps using UTC (equivalent to "-T utc")
-sort sort messages using value for specified key1 (secondary sort by key2 if provided)
-nsort numeric sort messages using value for specified key1 (secondary sort by key2 if provided)
-k key/value match
if no operator or value is given, checks for the existence of the key
if no operator is given, default is "eq"
-B only process log messages since last system boot
-C alias for "-k Facility com.apple.console"
-o begins a new query
queries are 'OR'ed together
The syslogd daemon will prune the data store after it starts. See syslogd(8).
-p must be followed by an expression, messages that match the expression are deleted.
A daily pruning operation should be started by cron specified for Mac OSX 10.4 in /etc/periodic/daily/500.daily.
# Delete all messages after 7 days (-k Time lt -7d) # Delete Warning (Level 4) and above after 3 days (-k Time lt -3d -k Level ge 4) # Delete Info (Level 6) and above after 1 day (-k Time lt -1d -k Level ge 6) syslog -p -k Time lt -7d -o -k Time lt -3d -k Level ge 4 -o -k Time lt -1d -k Level ge 6
com.apple.newsyslog.plist
Label com.apple.newsyslog
ProgramArguments:/usr/sbin/newsyslog
LowPriorityIO: true
Nice 1
StartCalendarInterval:Minute 30
com.apple.syslogd.plist
From /System/Library/LaunchDaemons
reformatted by ed
/System/Library/LaunchDaemons > plutil -p com.apple.syslogd.plist
Label com.apple.syslogd
JetsamProperties { JetsamPriority -49 JetsamMemoryLimit 300 }
EnvironmentVariables { ASL_DISABLE 1 }
MachServices { com.apple.system.logger ; { ResetAtClose 1 } }
EnableTransactions 1
ProgramArguments [ 0 /usr/sbin/syslogd ]
Sockets ; { AppleSystemLogger { SockPathName /var/run/asl_input SockPathMode 438 }
BSDSystemLogger { SockPathName /var/run/syslog SockType dgram SockPathMode 438 }
}
HopefullyExitsLast => 1
OnDemand => 0
log displayer
macOS Sierra (10.12) introduced a new logging mechanism called Unified Logging.
The developer reference document states that the same mechanism will be used for iOS 10, tvOS 10, and watchOS 3 as well.
unified logs will take the places of Apple System Logs as well as Syslog which is what rely on quite heavily for log analysis on 10.11 and older systems. As of 10.12.1, these logs still exist in /var/log
The unified logs are stored in two directories:
/var/db/diagnostics/
/var/db/uuidtext/
/var/db/diagnostics/ contains log files named with a timestamp filename following the pattern logdata.Persistent.YYYYMMDDTHHMMSS.tracev3. binary files. Other files including additional log *.tracev3 files and others that contain logging metadata.
/var/db/uuidtext/ contains files that are references to tracev3 log files.
log collects, removs, configurs, and reviews logs data. The new Console application can be used to view logs in real-time (volatile logs)
log collect collects records from a certain timeframe, log size, or type into a *.logarchive archive bundle. *.logarchive files can be imported into the Console application.
log show parses binary logs either from a specific *.tracev3 file(s) or from a *.logarchive bundle . A user can filter on different predicates filters or time frames.
Made true HTML and terse by Dennis German
launchd
<key>Label</key> <string>com.apple.syslogd</string>
<key>OnDemand</key> <false/>
<key>HopefullyExitsLast</key> <true/>
<key>EnableTransactions</key> <true/>
<key>ProgramArguments</key> <array> <string>/usr/sbin/syslogd</string> </array>
<key>MachServices</key> <dict> <key>com.apple.system.logger</key> <true/> </dict>
<key>Sockets</key> <dict> <key>AppleSystemLogger</key>
<dict> <key>SockPathName</key> <string>/var/run/asl_input</string>
<key>SockPathMode</key> <integer>438</integer>
</dict>
<key>BSDSystemLogger</key>
<dict> <key>SockPathName</key> <string>/var/run/syslog</string>
<key>SockType</key> <string>dgram</string>
<key>SockPathMode</key> <integer>438</integer>
</dict>
</dict>
</dict>
OS X darwin plist for rotating logs newsyslog /System/Library/LaunchDaemons/com.apple.newsyslog.plist
<key>Label</key> <string>com.apple.newsyslog</string>
<key>ProgramArguments</key> <array> <string>/usr/sbin/newsyslog</string> </ array>
<key>LowPriorityIO</key> <true/>
<key>Nice</key> <integer>1</integer>
<key>StartCalendarInterval</key> <dict>
<key>Minute</key> <integer>30</integer> </dict>
syslogd [-nSLD] -o file][-l l,][-s kb][-b n][-C ikb] -R remoteHost[:port]
-R HOST[:PORT] |
/etc/syslog.conf.
On Onion omega:
Used by crond, ftpd, ifplugd, modprobe, nameif (local0), Show messages in syslogd's circular buffer, with
logread [-f] -f follow output data as log grows
How to get/set SYSLOG host from DHCP?