blogng/blog/2015-02-21-syslog-on-mac-os-x-cheat-sheet.markdown

---
comments: true
date: 2015-02-21 00:41
layout: post
tags: mac, osx, syslog, cheatsheet
title: 'Syslog on Mac OS X: Cheat Sheet'
---
This is a quick cheatsheet to work with [`syslog(1)`](https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/syslog.1.html) implementation OS X uses.

`Console.app` provides a nice UI to access logs in mac, you can do some basic filtering and search, but its limited in terms of raw control a terminal gives you.

`/usr/bin/syslog` can be used to both send and receive logs. Alternatively [`logger(1)`](https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/logger.1.html) can be used to send logs to syslog.

## Print logs from a specific facilitiy
```bash
# -w: similar to tailf
syslog -k Facility local1 -w
```

## Sending logs
```bash
# -l severity level
syslog -s "message"
```

## Sending logs upstream to another syslog server
Syslog can forward your logs too. The configuration resides in `/etc/syslog.conf`. You can append forwarding rules in this file, format is
```
# Tab separated
Facility.Level    @IPADDR:PORT
```
After this reload syslog daemon.
```
sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist
sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plistp
```

# Extra reading
1. [`asl.conf(5)`](https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man5/asl.conf.5.html) - Configuration file for Apple Syslog Log (A syslog superset apple implements), this is where all the logic to route logs are set
facility.level
intial commit 2017-01-22 21:30:42 +00:00			`---`
			`comments: true`
Convert from old categories to tags import sys import yaml with open(sys.argv[1]) as fp: data = fp.read() if not data.find("---") == 0: # no head print("NO YAML HEAD FOUND") sys.exit(-1) data = data[3:] head_end = data.find("---") head = data[0:head_end] data = data[head_end+3:] metadata = yaml.safe_load(head) cats = metadata.pop('categories', None) if cats != None: if type(cats) == list: tags = cats elif type(cats) == str: tags = cats.split() tags = list(map(lambda t: t.lower(), tags)) metadata["tags"] = ", ".join(tags) new_data = f"---\n{yaml.dump(metadata, default_flow_style=False)}---{data}" # write it print(f"coverted: categories to tags: {tags} - {sys.argv[1]}") with open(sys.argv[1], "w") as fp: fp.write(new_data) sys.exit(0) if not metadata.get("tags", None): metadata["tags"] = "untagged" new_data = f"---\n{yaml.dump(metadata, default_flow_style=False)}---{data}" print(f"untagged: {sys.argv[1]}") # write it with open(sys.argv[1], "w") as fp: fp.write(new_data) sys.exit(0) print("No changes needed") 2019-01-28 22:16:27 +00:00			`date: 2015-02-21 00:41`
			`layout: post`
			`tags: mac, osx, syslog, cheatsheet`
			`title: 'Syslog on Mac OS X: Cheat Sheet'`
intial commit 2017-01-22 21:30:42 +00:00			`---`
			This is a quick cheatsheet to work with [`syslog(1)`](https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/syslog.1.html) implementation OS X uses.

			`Console.app` provides a nice UI to access logs in mac, you can do some basic filtering and search, but its limited in terms of raw control a terminal gives you.

			`/usr/bin/syslog` can be used to both send and receive logs. Alternatively [`logger(1)`](https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/logger.1.html) can be used to send logs to syslog.

			`## Print logs from a specific facilitiy`
			```bash
			`# -w: similar to tailf`
			`syslog -k Facility local1 -w`
			```

			`## Sending logs`
			```bash
			`# -l severity level`
			`syslog -s "message"`
			```

			`## Sending logs upstream to another syslog server`
			Syslog can forward your logs too. The configuration resides in `/etc/syslog.conf`. You can append forwarding rules in this file, format is
			```
			`# Tab separated`
			`Facility.Level @IPADDR:PORT`
			```
			`After this reload syslog daemon.`
			```
			`sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist`
			`sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plistp`
			```

			`# Extra reading`
			1. [`asl.conf(5)`](https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man5/asl.conf.5.html) - Configuration file for Apple Syslog Log (A syslog superset apple implements), this is where all the logic to route logs are set
			`facility.level`