5485 Views 14 Replies Latest reply: Nov 25, 2009 5:04 AM by Jun T.
I realize that the backupd entries are <notice> level so they are being discarded once the TTL is up, while the kernel entries are being archived.
I guess the level of the messages is not relevant here. It seems file system error messages from kernel have default ttl of about 1 year. See 'man syslogd' and search for -fs_ttl option.
I have tried the command aslmanager -ttl 7
Please try specifying the options for aslmanager in
Thanks for the replies.
gondor123, I don't think that applies to my situation.
Jun T., the -fs_ttl option doesn't seem useful to me. I want the notice level messages to be retained longer. The kernel messages are already being retained longer than 2 days, which is what -fs_ttl is for.
I have modified the file /System/Library/LaunchDaemons/com.apple.aslmanager.plist by adding in the ttl and the 7 lines as seen below with a few lines of the surrounding file for context.
What happens after that edit is that the logs are saved for 7 days, but rebooting the computer causes the logs to be discarded as if it was still using the 2 day default. The com.apple.aslmanager.plist retains my -ttl setting after the reboot, but the log entries are discarded after 2 days. I have also tried to unload the com.apple.aslmanager.plist file with launchctl before making the change, and then load it again, but after a reboot any saved logs past the 2 day limit are still discarded.
twtwtw, I have tried sudo aslmanager -a -ttl 7 and sudo aslmanager -ttl 7 without effect.
That gave me this message:
Set ASL Data Store syslog filter mask: Emergency - Notice
Emergency to Notice is the default level as far as I know so I don't know what that would have done. However, after running that command I can no longer open Console.app. Any idea how I can reverse that? I've tried removing the preference file for Console, opening log files directly in Console and running the periodic maintenance script but Console.app is still crashing on launch.
well that's weird: it obviously did something (even if it didn't do what was intended). I can't replicate the problem on my end (console.app opens fine) so it must be an interaction with one of the changes you made previously to aslmanager. try restoring the old aslmanager plist file and restarting the machine.
I had already reverted the aslmanager.plist file, but I made that change a while back so I didn't think that would fix the console problem. I tested in a new user but Console.app wouldn't open there either. It says no log selected on the bottom left while beach balling for a few seconds before crashing.
I ran pacifist to reinstall Console from my 10.5 disk and that seems to have fixed it for the most part. "All Messages" and "Console Messages" are now blank, but all of the other logs are there, and it isn't crashing.
I also noticed that now when I run syslog the last line in it's entirety is:
New entries are going above that line, so I may try wiping out today's asl entries and see if things return to normal.
There are also a few lines like these:
Mon Nov 23 18:15:06 G5 com.apple.launchd (\[0x0-0x28028\].com.apple.Console) <Warning>: Exited abnormally: Segmentation fault
Nov 23 18:43:30 G5 com.apple.launchd (com.apple.aslmanager): Exited abnormally: Segmentation fault
As an aside, I'm running Leopard. Do you have Leopard or Snow Leopard?
Yes, I've restarted.
Pulling today's entries out of /var/log/asl/ means I am seeing yesterday's entries, but it still ends with the line "Segmentation fault"
Do you know which file holds the settings for syslog that would be modified by running sudo syslog -c syslogd -n? I'm thinking perhaps I can roll back to an earlier version of that file.
I also ran this:
syslog -c 0
which gave the result:
Master filter mask: Off
I think sudo syslog -c syslogd -n is specifying the level of filters for the syslogd process only, right?
well, it has no plist file that I can locate, so it may hold the settings in memory, without saving them to disk (or it may save them way down in the inaccessible root folders...). and yeah, all that command should do is set the logging level preferences for the daemon, which is why I was surprised it had any other effects.
I want the notice level messages to be retained longer
The reason that the messages from backupd is discared is not that they are notice level. The default TTL is 2 days for most of the messages, *irrespective of the level of the message*. Exceptions are the following two types of messages which have default TTL of about 1 year; (1) messages used by the utmp, wtmp, and lastlog subsystems, and (2) filesystem error messages generated by the kernel. These messages are saved in LongTTL*asl. I guess the old messages from kernel you are seeing are of type (2) (you can view the contents of LongTTL.asl by 'syslog -f LontTTL.asl').
but rebooting the computer causes the logs to be discarded as if it was still using the 2 day default
Hmm, if this is the case, then maybe aslmanager is run not only by launchd (through the plist file) but also by some other processes (syslogd ?). aslmanager manpages says:
"aslmanager is started automatically at various times. It runs shortly after the syslogd server starts, at midnight (local time) if the system is running, and any time a file in the ASL data store directory (/var/log/asl) reaches a maximum size limit..."
syslogd is started at boot time so "shortly after the syslogd server starts" means (shortly after) boot time? Is your Mac running at midnight?
Anyway, in Leopard, I have no idea how to pass the options to aslmanager if it is not started by launchd. In Snow Leopard /etc/asl.conf can contain options for aslmanager, but this is not the case in Leopard.
Well, I couldn't find out how to fix my Console.app problem so I reverted my OS to a backup and all is well on that front.
I think I figured out why aslmanager is clearing my logs early: I backed up the default aslmanager.plist in the LaunchDaemons directory, and while I thought I disabled that original file, I did not. So effectively I had two files active, one with a 2 day ttl and one with a 5 day ttl. I'll have to wait a few days to be sure that that was indeed the error but I think it was.
I do think aslmanager.plist on Leopard is run only by launchd. My Mac is on at midnight, but I guess at boot the entire LaunchDaemons directory gets a scan by launchd and my duplicate plist gets run at that point.
I'm curious to see what is in /etc/asl.conf file by default in SL as I'd like my script to run on 10.5 and 10.6. Do you know if editing aslmanager.plist in SL will work or are changes required to be in /etc/asl.conf?
Here is what is 10.5's /etc/asl.conf
Q [= Facility authpriv] access 0 80
Q [= Facility remoteauth] [N<= Level 2] access 0 80
Thanks for the help everyone.
Default /etc/asl.conf in SL has lots of lines like
Q [op name value] action
but contains no options for aslmanager, although a user can add options for aslmanager in etc/asl.conf (according to the manpage; I have never tried this).
The default TTL is changed from 2day in Leopard to 7 days in SL; aslmanager keeps 1 week of logs without any options in SL.