On Mon, Jun 12, 2023 at 12:51:33AM -0400, "Daniel J. Luke" <[email protected]> wrote:
> On Jun 12, 2023, at 12:39 AM, raf via macports-users > <[email protected]> wrote: > > Does anyone known where auth.* logs end up? Or if they don't end up > > anywhere, is there a way to make them go somewhere? > > syslog stuff has changed a few times with MacOS .. I think the asl stuff > stopped being default in ~ 10.12. > > You should be able to see the logs with `log stream --style syslog` > (you can do filtering to get it to just show you the messages you care > about). > > -- > Daniel J. Luke Thanks, Daniel. It's wierd that plenty of logs are going into /var/log/system.log, just not the ones I try to send via logger/syslog(). :-) The log(1) manual entry doesn't mention "auth" anywhere, and the only mention of syslog is as an output format, not as a source. Can you suggest a log command that will show syslog auth.{err,info} messages? Or do I have to read the Predicate Programming Guide to work it out? :-) [Rhetorical] What I'd really like is a command to tell the logging system to send auth.* syslog messages to /var/log/system.log (or better still /var/log/auth.log). I probably won't get what I want, but the log command above is very helpful. This command shows the messages sent by logger(1): sudo log show --style syslog --info --predicate 'process=="logger"' But it's less than ideal with my program which sets the syslog program name to "sshdo", but the logging system seems to just discard that information (and the syslog facility). Instead, it uses "Python" as the program name (because sshdo is a python script). I can get it to show the logs I want with this: log show --style syslog --info --predicate ' process == "Python" and composedMessage contains "type=" and composedMessage contains "user=" and composedMessage contains "command=" ' Thanks again. cheers, raf
