Logging to syslog (by unbound, nsd, etc.) disappearing in a black hole

[Gerben Wierda]

> On 15 Aug 2019, at 17:48, Daniel J. Luke <dluke at geeklair.net> wrote:
> 
> High Sierra switched the way syslog works on Mac OS (see https://developer.apple.com/documentation/os/logging <https://developer.apple.com/documentation/os/logging>). This replaced the ASL (and syslog) stuff.

I first thought: that can’t be right, can it? ASL is still there, /etc/asl and /etc/.asl.conf is still there. Man pages are still there. syslogd runs in the background. Console and log work against the ASL infrastructure. asl.conf contains all this information (as described in the man page for asl.conf).

A command like logger still works (produces syslog messages).

But then I found https://eclecticlight.co/2018/03/19/macos-unified-log-1-why-what-and-how/ <https://eclecticlight.co/2018/03/19/macos-unified-log-1-why-what-and-how/>

Now, that says that syslog messages also end up in Unified Logging. What it doesn’t say how for instance old style messages for facility mail with level notice end up there. Or with facility daemon with level info. So, how to get these out is still a riddle.

I have found a GUI app: https://eclecticlight.co/consolation-t2m2-and-log-utilities/ <https://eclecticlight.co/consolation-t2m2-and-log-utilities/>

So, I’m going to try that.

Or I’m going to live with the fact that unbound and nsd write logs in the chroot-ed /opt/local/etc/{nsd,unbound} and figure out how to get log rotation working for these while unbound and nsd keep running.

Why did Apple leave all the ASL stuff in place if it isn’t functional anymore? It’s still there in Mojave. Why did they not offer a decent compatibility? Afraid people would not move to OS-specific log commands? Sigh.

G

> 
> you can use the 'log' command line utility to view the logs.
> 
> [I am not a fan of the way this stuff works now]
> 
>> On Aug 15, 2019, at 3:46 AM, Gerben Wierda <gerben.wierda at rna.nl> wrote:
>> 
>> I’m running unbound. If I use file logging, it neatly ends up in the file I want. If I set syslog in the conf file (this is standard in macports unbound by the way) I get nothing. Logging disappears into a black hole, probably the same black hole where mail logging from postfix disappears in on High Sierra Server.
>> 
>>       use-syslog: <yes or no>
>>              Sets unbound to send log messages to  the  syslogd,  using  sys-
>>              log(3).   The  log  facility  LOG_DAEMON  is used, with identity
>>              "unbound".  The logfile setting is overridden when use-syslog is
>>              turned on.  The default is to log to syslog.
>> 
>> How do I make sure that I get to see the syslog messages. Probably by adapting /etc/asl.conf and /etc/syslog.conf? Or is it a matter of ASL hiding these kinds of messages from ordinary users? Is there a way to tell asl/syslog to put the logging output of unbound into a (log rotated) file in e.g. /var/log?
>> 
>> PS. Apple is apparently playing around with unbound too:
>> 
>> luna:~ gerben$ ls -l /usr/share/man/man8/unbound.8 
>> -rw-r--r--  1 root  wheel  2342 Aug 23  2018 /usr/share/man/man8/unbound.8
> 
> -- 
> Daniel J. Luke

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.macports.org/pipermail/macports-users/attachments/20190815/f06fe102/attachment.html>