7

I try to send a log message to syslog via

logger -is -t TestApp -p user.error TEST MESSAGE1

Then I check if it is there

tail system.log
...
Apr 12 16:33:00 HOSTNAME TestApp[3024]: TEST MESSAGE1

So it works. Then I try to do the same via a compiled application.

openlog("TestApp", LOG_PID, LOG_USER);
setlogmask(LOG_UPTO(LOG_DEBUG));
syslog(LOG_ERR, "TEST MESSAGE2");
closelog();

I run the application then I check system.log

tail system.log
...
Apr 12 16:33:00 HOSTNAME TestApp[3024]: TEST MESSAGE1
....

and I cannot find "TEST MESSAGE 2" there. I also try to check it via "syslog"

syslog -s -l er TEST MESSAGE3

Same result. I cannot see the message in the log file. OK. There might be some problems with log settings. So I try to configure logging to a specific file. I create /etc/asl/TestApp

# ASL configuration for TestApp
#
> /var/log/TestApp.log mode=0640 format=bsd rotate=seq compress file_max=1M all_max=5M
#
? [= Sender TestApp] file /var/log/TestApp.log
? [= Sender TestApp] [<= Level debug] claim

I restart both syslogd and ASL.

launchctl stop com.apple.syslogd
launchctl stop com.apple.aslmanager
launchctl start com.apple.aslmanager
launchctl start com.apple.syslogd

Then I try to send a message via "logger" again and check the logs 

tail TestApp.log
Apr 12 16:47:49 HOSTNAME TestApp[3062]: TEST MESSAGE1

So "logger" works again. I try to do the same via the compiled application but I cannot see "TEST MESSAGE2". Then I do the same via "syslog -s -l er TEST MESSAGE3". Again I cannot see the message in TestApp.log and system.log.

I read the information about logging in macOS and it describes some changes but it does not say the old syslog method will not work.

What am I doing wrong? Why is "logger" working but "syslog" and my compiled (Hello World) application are not working?

Thanks

Eugen
  • 479
  • 5
  • 16
  • Does [Where do DEBUG and INFO messages go when using Python's sysloghandler on Mac OSX?](https://stackoverflow.com/questions/22004505) . I know it says 'Python', but the underlying syslogd is the same for Python and C++ (and C and …). – Jonathan Leffler Apr 12 '18 at 22:08
  • On second thoughts, it probably doesn't help. – Jonathan Leffler Apr 12 '18 at 22:20
  • Jonathan, thank you anyway. That is the reason why I use LOG_ERR. Anyway I have just tried to edit asl.conf and set "? [<= Level debug] file system.log", restarted daemons and looks like it is not working. – Eugen Apr 12 '18 at 22:33

1 Answers1

11

Apple broke syslog(3) functionality in macOS Sierra and it continues to be broken in High Sierra. There's not adequate words to describe how stupid Apple's change was.

The closest one might be able to come to seeing log messages sent by compiled programs (including the PHP interpreter, for example) is to use a command like this to pull them out of Apple's obtuse storage:

log stream --info --debug --predicate 'sender == "<your-app-name>"' --style syslog

But that only results in part of the syslog functionality. There's no support for sending logs to a central collection point via UDP, and most of the 8 urgency levels are now missing. The facility coding is likewise hobbled.

CXJ
  • 4,301
  • 3
  • 32
  • 62
  • great answer! I could use it to tail the ios simulator log now! but how could I get the real device log as it shows in the Console.app? – fatfatson Jul 10 '18 at 03:11
  • I'm sorry, I don't know. If you find out, please post it here! – CXJ Jul 16 '18 at 22:07
  • 1
    This still seems to be the case in Monterey. I can't get my Go programs to log to syslog. The `log stream` hack doesn't work, either. – parzival Apr 30 '22 at 21:12
  • @parzival I'm seeing the same with a Go program on macOS 12. I'm used to having to log with `LOG_NOTICE` severity (since `LOG_INFO` and `LOG_DEBUG` messages get dropped by default on macOS), but even that's not working anymore. Did you manage to get things working? – xyz Sep 19 '22 at 13:28
  • 2
    @xyz I ended up writing logs directly to files. – parzival Sep 20 '22 at 16:34