syslogd support

mike-d157 wrote:

1) Did syslogd/syslog.conf under Mac OS X ever actually support the program/hostname block concept mentioned in the first couple of links (particularly the first one)? These features aren't documented as far as Apple is concerned, but that doesn't necessarily mean they don't work, esp. if the Apple code was really derived from FreeBSD.

The BSD pedigree of OS X is poorly understood. I can't comment on any random, decade-old blog posts.

2) If syslog.conf program/hostname blocks ever worked, was there an OS X release with which they stopped working, and if so, what was that release?

How would someone know that? OS X is a consumer operating system. There is virtually no one that has ever turned on remote logging. I'm pretty sure there is no one who has had it turned on with each and every OS version.

3) Assuming a hostname block is available, from the (FreeBSD) documentation available, it appears one could specify the following at the beginning of syslog.conf:

#+ipaddr1

*.* /var/log/remote/remsys1.log

#+*

#+ipaddr2

*.* /var/log/remote/remsys2.log

#+*

#...rest of supplied syslog.conf...

OS X is not FreeBSD. It has some similarities and a bit of shared lineage, but the only BSD features that work identically in OS X are only those that haven't been changed in OS X.

Conceptually, the desired behavior is to log all messages from ipaddr1 and ipaddr2 exclusively to /var/log/remote/remsys1.log and /var/log/remote/remsys2.log, respectively. Is this the correct syntax and will it result in the desired behavior?

No and no.

What you want to do is this:

Add the following lines to /System/Library/LaunchDaemons/com.apple.syslogd.plist under the "Sockets" dict.

<key>NetworkListener</key>

<dict>

<key>SockServiceName</key>

<string>syslog</string>

<key>SockType</key>

<string>dgram</string>

</dict>

This file is binary so you will have to open it in a tool like TextWrangler that can understand it. Save the old file in case you screw it up. When you recreate the file you can just copy all of the text from TextWrangler and save it as a text plist. If you are going to be hacking around on this file you probably want it to be text anyway.

Then add the following to be beginning of /etc/asl.log

? [A= Host remsys1] file /var/log/remsys1.log file_max=5M all_max=50M

? [A= Host remsys1] ignore

Add these same two lines for each remote system. The "Host" key seems to be poorly documented. It is in the source but not the man page. The "A" stands for prefix match. I don't know if this would work for IP address too. You may need to manually create /var/log/remsys1.log at first.

Reload syslogd with launchctl to get the server running.

On the client side, the old docs still seem to be correct. Just add:

*.* @server

to /etc/syslog.conf