How to configure syslogd to listen to UDP in El Capitan?

Question

Level 1

107 points

How to configure syslogd to listen to UDP in El Capitan?

Older Apple Airport base stations have the ability to log via syslog’s UDP transport. By default, however, syslogd on Mac OS X doesn’t set up a UDP listener.

In Yosemite, it was relatively easy to enable the UDP listener by editing /System/Library/LaunchDaemons/com.apple.syslogd.plist, as described in the syslogd(8) man page. Presumably the same would work in El Capitan, except that the sandbox prevents modification of that file.

I’d rather not disable System Integrity Protection just to make this change, and it seems like an oversight that there isn’t a way to configure this which doesn’t involve changing a file in /System. Is there any other mechanism which I’m overlooking?

Mac mini, OS X El Capitan (10.11.1)

Posted on Nov 4, 2015 1:45 PM

Reply

Answer 1

dono42

Level 1

8 points

Feb 12, 2016 3:09 PM in response to Anton Rang

Agree with issue as of 10.11.3 still there. Using syslog should be trivial.

Reply

Answer 2

Barney-15E

Level 10

112,620 points

Feb 13, 2016 8:08 AM in response to Anton Rang

They probably should create a different log configuration file or an API to modify entries, but you don't have to permanently disable SIP. You would just need to disable SIP to add the entry and then re-enable SIP. Or, boot from another drive and edit the file.

Reply

Answer 3

aviram

Level 1

21 points

Feb 26, 2016 12:47 AM in response to Anton Rang

Similarly, I would like to add my netgear router log to syslog.

I need to be able to monitor my son's internet usage, and the router logs all traffic...

found this on the net: http://hmijailblog.blogspot.com/2015/03/using-os-xs-syslogd-to-receive-log.html

but it requires editing the plist, which is no longer possible due to SIP

the author also mentions the use of syslog-ng, but I that might take longer to figure out how to configure to co-exist with apple's syslogd, and I rather not disable apple's syslogd...

thanks,

-avi

Reply

Answer 4

Barney-15E

Level 10

112,620 points

Feb 26, 2016 4:39 AM in response to aviram

As I already stated, disable SIP, edit the file, then re-enable SIP. SIP doesn't prevent the changes from working, it prevents modification.

Reply