os x 10.12 sierra syslog

[Daniel J. Luke]

On Sep 26, 2016, at 4:19 PM, Steve Wardle <smw1885 at icloud.com> wrote:
>> Please check Console.app instead. macOS 10.12 Sierra introduces "Unified
>> Logging" that now longer writes to log files on disk.
>> 
>> There is also a log(1) command line utility to query the log database.
>> 
>> https://developer.apple.com/reference/os/1891852-logging
> 
> Thanks but I’d seen that article.
> The log command returns nothing for any of the applications which log to the mail facility.

This also means that applications that read log files and act on them (like sshguard) need to be dealt with.

Anyone have an example of how to get the new logging system to actually write out logs? (Maybe something in /Library/Preferences/Logging/Subsystems/ ?) Ideally, I'd like to put all logs from one application in a file (ie sshd logs into one file, postfix logs into another file).

I had some custom syslog logging that I pulled forward into asl config (from syslog.conf to /etc/asl.conf to /etc/asl/net.geekalir.foo files) that I guess I need to modify once again if I want it to keep working. 

-- 
Daniel J. Luke