syslog()

[Daniel J. Luke]

On Jun 12, 2023, at 7:59 AM, raf via macports-users <macports-users at lists.macports.org> wrote:
> Thanks, Daniel. It's wierd that plenty of logs are
> going into /var/log/system.log, just not the ones I try
> to send via logger/syslog(). :-)

IIRC stuff that was linked against older systems still sends syslogs through asl and they'd end up in those logfiles like you'd exepct.

> The log(1) manual entry doesn't mention "auth"
> anywhere, and the only mention of syslog is as an
> output format, not as a source. Can you suggest a log
> command that will show syslog auth.{err,info} messages?
> Or do I have to read the Predicate Programming Guide to
> work it out? :-) [Rhetorical]

I don't think the unified logging stuff has a direct translation for classic syslogd, so there's not really an auth.{err,info}

I usually start with something like

`log show --info --style syslog --last 24h --predicate 'processImagePath contains "foo"'` or
`log show --info --style syslog --last 24h --predicate 'eventMessage contains "bar"'`

... and adjust it until I get the data I want.

> What I'd really like is a command to tell the logging
> system to send auth.* syslog messages to
> /var/log/system.log (or better still
> /var/log/auth.log). I probably won't get what I want,
> but the log command above is very helpful.

There's not a way to do that directly. You can run a copy of 'log' and stream the output to a file.

> But it's less than ideal with my program which sets the
> syslog program name to "sshdo", but the logging system
> seems to just discard that information (and the syslog
> facility). Instead, it uses "Python" as the program
> name (because sshdo is a python script).

Yep, I've had this same problem - for most things I just ended up switching them to not use syslog API.

Mostly I accept that MacOS logging is it's own thing now and I'm happier if I don't expect it to work like a normal unix box.

-- 
Daniel J. Luke