syslog()

[raf]

On Mon, Jun 12, 2023 at 12:51:33AM -0400, "Daniel J. Luke" <dluke at geeklair.net> wrote:

> On Jun 12, 2023, at 12:39 AM, raf via macports-users <macports-users at lists.macports.org> wrote:
> > Does anyone known where auth.* logs end up? Or if they don't end up
> > anywhere, is there a way to make them go somewhere?
> 
> syslog stuff has changed a few times with MacOS .. I think the asl stuff stopped being default in ~ 10.12.
> 
> You should be able to see the logs with `log stream --style syslog`
> (you can do filtering to get it to just show you the messages you care
> about).
> 
> -- 
> Daniel J. Luke

Thanks, Daniel. It's wierd that plenty of logs are
going into /var/log/system.log, just not the ones I try
to send via logger/syslog(). :-)

The log(1) manual entry doesn't mention "auth"
anywhere, and the only mention of syslog is as an
output format, not as a source. Can you suggest a log
command that will show syslog auth.{err,info} messages?
Or do I have to read the Predicate Programming Guide to
work it out? :-) [Rhetorical]

What I'd really like is a command to tell the logging
system to send auth.* syslog messages to
/var/log/system.log (or better still
/var/log/auth.log). I probably won't get what I want,
but the log command above is very helpful.

This command shows the messages sent by logger(1):

  sudo log show --style syslog --info --predicate 'process=="logger"'

But it's less than ideal with my program which sets the
syslog program name to "sshdo", but the logging system
seems to just discard that information (and the syslog
facility). Instead, it uses "Python" as the program
name (because sshdo is a python script).

I can get it to show the logs I want with this:

  log show --style syslog --info --predicate '
    process == "Python" and
    composedMessage contains "type=" and
    composedMessage contains "user=" and
    composedMessage contains "command="
  '

Thanks again.

cheers,
raf