os x 10.12 sierra syslog

[Daniel J. Luke]

On Sep 30, 2016, at 4:24 PM, Daniel J. Luke <dluke at geeklair.net> wrote:
> On Sep 26, 2016, at 4:19 PM, Steve Wardle <smw1885 at icloud.com> wrote:
>>> Please check Console.app instead. macOS 10.12 Sierra introduces "Unified
>>> Logging" that now longer writes to log files on disk.
>>> 
>>> There is also a log(1) command line utility to query the log database.
>>> 
>>> https://developer.apple.com/reference/os/1891852-logging
>> 
>> Thanks but I’d seen that article.
>> The log command returns nothing for any of the applications which log to the mail facility.
> 
> This also means that applications that read log files and act on them (like sshguard) need to be dealt with.
> 
> Anyone have an example of how to get the new logging system to actually write out logs? (Maybe something in /Library/Preferences/Logging/Subsystems/ ?) Ideally, I'd like to put all logs from one application in a file (ie sshd logs into one file, postfix logs into another file).
> 
> I had some custom syslog logging that I pulled forward into asl config (from syslog.conf to /etc/asl.conf to /etc/asl/net.geekalir.foo files) that I guess I need to modify once again if I want it to keep working. 

For the list archives, my hack for now is a launchd.plist that runs 'log stream --style syslog --predicate (processImagePath contains "programIcareAbout")' with StandardOutPath set.

I imagine (and hope) that there's a better way to do this.

-- 
Daniel J. Luke