On Jun 12, 2023, at 7:59 AM, raf via macports-users <macports-users@lists.macports.org> wrote: > Thanks, Daniel. It's wierd that plenty of logs are > going into /var/log/system.log, just not the ones I try > to send via logger/syslog(). :-)
IIRC stuff that was linked against older systems still sends syslogs through asl and they'd end up in those logfiles like you'd exepct. > The log(1) manual entry doesn't mention "auth" > anywhere, and the only mention of syslog is as an > output format, not as a source. Can you suggest a log > command that will show syslog auth.{err,info} messages? > Or do I have to read the Predicate Programming Guide to > work it out? :-) [Rhetorical] I don't think the unified logging stuff has a direct translation for classic syslogd, so there's not really an auth.{err,info} I usually start with something like `log show --info --style syslog --last 24h --predicate 'processImagePath contains "foo"'` or `log show --info --style syslog --last 24h --predicate 'eventMessage contains "bar"'` ... and adjust it until I get the data I want. > What I'd really like is a command to tell the logging > system to send auth.* syslog messages to > /var/log/system.log (or better still > /var/log/auth.log). I probably won't get what I want, > but the log command above is very helpful. There's not a way to do that directly. You can run a copy of 'log' and stream the output to a file. > But it's less than ideal with my program which sets the > syslog program name to "sshdo", but the logging system > seems to just discard that information (and the syslog > facility). Instead, it uses "Python" as the program > name (because sshdo is a python script). Yep, I've had this same problem - for most things I just ended up switching them to not use syslog API. Mostly I accept that MacOS logging is it's own thing now and I'm happier if I don't expect it to work like a normal unix box. -- Daniel J. Luke