|
|
This manual page is for Mac OS X version 10.6.3If you are running a different version of Mac OS X, view the documentation locally:
Reading manual pagesManual pages are intended as a quick reference for people who already understand a technology.
|
SYSLOG(1) BSD General Commands Manual SYSLOG(1)
NAME
syslog -- Apple System Log utility
SYNOPSIS
syslog -help
syslog -s [-r host] [-l level] message...
syslog -s [-r host] -k key val [key val] ...
syslog -C
syslog [-f file ...] [-d dir ...] [-w [n]] [-F format] [-T format] [-E format] expression
syslog [-f file ...] [-d dir ...] -x file expression
syslog -c process [filter]
DESCRIPTION
syslog is a command-line utility for a variety of tasks relating to the Apple System Log (ASL) facil-ity. facility.
ity. It provides mechanisms for sending and viewing log messages, copying log messages to ASL format
data store files, and for controlling the flow of log messages from client processes.
When invoked with the -help option, syslog prints a usage message.
SENDING MESSAGES
The -s option is used send log messages to the syslogd(8) log message daemon, either locally or to a
remote server if the -r host option in used.
There are two main forms of the command. If the -k option is used, then it must be followed by a list
of keys and values. A structured message will be sent to the server with the keys and values given as
arguments. If a key or a value has embedded white space, it must be enclosed in quotes.
Note that the text of the log message should be supplied as a value following the ``Message'' key.
If the -k option is not specified, then the rest of the command line is treated as the message text.
The text may be preceded by -l level to set the log level (priority) of the message. Levels may be an
integer value corresponding the the log levels specified in syslog(3) or asl(3), or they may be a
string. String values are case insensitive, and should be one of:
Emergency (level 0)
Alert (level 1)
Critical (level 2)
Error (level 3)
Warning (level 4)
Notice (level 5)
Info (level 6)
Debug (level 7)
The string ``Panic'' is an alias for ``Emergency''.
If the -l option is omitted, the log level defaults to 7 (Debug).
syslog only requires one or two leading characters for a level specification. A single character suf-fices suffices
fices in most cases. Use ``P'' or ``Em'' for Panic / Emergency, and ``Er'' or ``X'' for Error).
READING MESSAGES
The syslogd daemon filters and saves log messages to different output streams. One module saves mes-sages messages
sages to files specified in the syslog.conf(5) file. Those log files may be examined with any file
printing or editing utility, e.g.
cat /var/log/system.log
Another module saves messages in a data store (/var/log/asl).
If invoked with no arguments, syslog fetchs all messages from the active data store. Messages are then
printed to standard output, subject to formatting options and character encoding as described below.
Some log messages are read-access controlled, so only messages that are readable by the user running
syslog will be fetched and printed.
If invoked with the -C option, syslog fetches and prints console messages. The -C option is actually
an alias for the expression:
-k Facility com.apple.console
See the EXPRESSIONS section below for more details.
Individual ASL data store files may be read by providing one or more file names as arguments to the -f
option. This may be useful when searching archived files, files on alternate disk volumes, or files
created as export files with the -x option.
The -d option may be followed by a list of directory paths. syslog will read or search all ASL data
store files in those directories. Any files that are not readable will be skipped. Specifying -d with
the name ``archive'' will open all readable files in the default ASL archive directory /var/log/asl.ar-chive. /var/log/asl.archive.
chive. Specifying -d with the name ``store'' will open all readable files in the ASL store directory
/var/log/asl.
Legacy ASL database files that were written by syslogd on Mac OS X 10.5 (Leopard) may also be read
using the -f option. However only one such legacy database may be read or searched at a time. Note
that a legacy database may be read and copied into a new ASL data store format file using a combination
of -f and -x options.
The -w option causes syslog to wait for new messages. By default, syslog prints the last 10 messages,
then waits for new messages to be added to the data store. A number following the -w option specifies
the number of messages to print and overrides the default value of 10. For example:
syslog -w 20
This usage is similar to watching a log file using, e.g.
tail -f /var/log/system.log
The -w option can only be used when reading the system's ASL data store or when reading a single data
store file, and when printing messages to standard output.
If the -x file option is specified, messages are copied to the named file rather than being printed.
The file will be created if it does not exist.
When called without the -x option, messages are printed to standard output. Messages are printed in a
format similar to that used in the system.log file, except that the message priority level is printed
between angle-brackets.
The output format may by changed by specifying the -F format option. Non-printable and control charac-ters characters
ters are encoded by default. Text encoding may be controlled using the -E option (see below). The
value of format may be one of the following:
bsd Format used by the syslogd daemon for system log files, e.g. /var/log/system.log.
std Standard (default) format. Similar to ``bsd'', but includes the message priority level.
raw Prints the complete message structure. Each key/value pair is enclosed in square brackets.
Embedded closing brackets and white space are escaped. Time stamps are printed as seconds since
the epoch by default, but may also be printed in local time or UTC if the -T option is specified
(see below).
xml The list of messages is printed as an XML property list. Each message is represented as a dic-tionary dictionary
tionary in a array. Dictionary keys represent message keys. Dictionary values are strings.
The value of the format argument may also be a custom print format string. A custom format should in
most cases be enclosed in single quotes to prevent the shell from substituting special characters and
breaking at white space.
Custom format strings may include variables of the form ``$Name'' (or ``$(Name)'' if the variable is
not delimited by whitespace) which will be expanded to the associated with the named key. For example,
the command:
syslog -F '$Time $Host $(Sender)[$(PID)]: $Message'
produces output similar to the ``bsd'' format.
Timestamps may be printed in three formats. Times are generally converted to local time, except when
the -F sec option is used, in which case times are printed as the number of seconds since the epoch.
The -T format option may be used to explicity control the format used for timestamps. The value of
format may be one of the following:
sec Times are printed as the number of seconds since the epoch.
local Times are converted to the local time zone, and printed with the format
MMM DD HH:MM:SS
utc Times are converted to UTC, and printed with the format
YYYY.MM.DD HH:MM:SS UTC
The -u option is a short form for -T utc.
By default, control characters and non-printable characters are encoded in the output stream. In some
cases this may make messages less natural in appearance. The encoding is designed to preserve all the
information in the log message, and to prevent malicious users from spoofing or obsucring information
in log messages.
Text in the ``std'', ``bsd'', and ``raw'' formats is encoded as it is by the vis utility with the -c
option. Newlines and tabs are also encoded as "\n" and "\t" respectively. In ``raw'' format, space
characters embedded in log message keys are encoded as "\s" and embedded brackets are escaped to print
as "\[" and "\]".
XML format output requires that keys are valid UTF8 strings. Keys which are not valid UTF8 are
ignored, and the associated value is not printed.
Values that contain legal UTF8 are printed as strings. Ampersand, less than, greater than, quotation
mark, and apostrophe characters are encoded according to XML conventions. Embedded control characters
are encoded as ``&#xNN;'' where NN is the character's hexidecimal value.
Values that do not contain legal UTF8 are encoded in base-64 and printed as data objects.
The -E format option may be used to explicity control the text encoding. The value of format may be
one of the following:
vis The default encoding described above.
safe Encodes backspace characters as ^H. Carriage returns are mapped to newlines. A tab character is
appended after newlines so that message text is indented.
none No encoding is used.
The intent of the ``safe'' encoding is to prevent obvious message spoofing or damage. The appearance
of messages printed will depend on terminal settings and UTF-8 string handling. It is possible that
messages printed using the ``safe'' or ``none'' options may be garbled or subject to manipulation
through the use of control characters and control sequences embedded in user-supplied message text.
The default ``vis'' encoding should be used to view messages if there is any suspicion that message
text may have been used to manipulate the printed representation.
If no further command line options are specified, syslog displays all messages, or copies all messages
to a data store file. However, an expression may be specified using the -k and -o options.
EXPRESSIONS
Expressions specify matching criteria. They may be used to search for messages of interest.
A simple expression has the form:
-k key [[op] val]
The -k option may be followed by one, two, or three arguments. A single argument causes a match to
occur if a message has the specified key, regardless of value. If two arguments are specified, a match
occurs when a message has exactly the specified value for a given key. For example, to find all mes-sages messages
sages sent by the portmap process:
syslog -k Sender portmap
Note that the -C option is treated as an alias for the expression:
-k Facility com.apple.console
This provides a quick way to search for console messages.
If three arguments are given, they are of the form -k key operation value. syslog supports the follow-ing following
ing matching operators:
eq equal
ne not equal
gt greater than
ge greater than or equal to
lt less than
le less than or equal to
Additionally, the operator may be preceded by one or more of the following modifiers:
C case-fold
R regular expression (see regex(3))
S substring
A prefix
Z suffix
N numeric comparison
More complex search expressions may be built by combining two or more simple expressions. A complex
expression that has more than one ``-k key [[op] val]'' term matches a message if all of the key-value
operations match. Logically, the result is an AND of all of key-value operations. For example:
syslog -k Sender portmap -k Time ge -2h
finds all messages sent by portmap in the last 2 hours (-2h means "two hours ago").
The -o option may be used to build even more complex searches by providing an OR operation. If two or
more sub-expressions are given, separated by -o options, then a match occurs is a message matches any
of the sub-expressions. For example, to find all messages which have either a ``Sender'' value of
``portmap'' or that have a numeric priority level of 4 or less:
syslog -k Sender portmap -o -k Level Nle 4
Log priority levels are internally handled as an integer value between 0 and 7. Level values in
expressions may either be given as integers, or as string equivalents. See the table string values in
the SENDING MESSAGES section for details. The example query above could also be specified with the
command:
syslog -k Sender portmap -o -k Level Nle warning
A special convention exists for matching time stamps. An unsigned integer value is regarded as the
given number of seconds since 0 hours, 0 minutes, 0 seconds, January 1, 1970, Coordinated Universal
Time. An negative integer value is regarded as the given number of seconds before the current time.
For example, to find all messages of Error priority level (3) or less which were logged in the last 30
seconds:
syslog -k Level Nle error -k Time ge -30
a relative time value may be optionally followed by one of the characters ``s'', ``m'', ``h'', ``d'',
or ``w'' to specify seconds, minutes, hours, days, or weeks respectively. Upper case may be used
equivalently. A week is taken to be 7 complete days (i.e. 604800 seconds).
FILTERING CONTROLS
Clients of the Apple System Log facility using either the asl(3) or syslog(3) interfaces may specify a
log filter mask. The mask specifies which messages should be sent to the syslogd daemon by specifying
a yes/no setting for each priority level. Many clients set a filter mask to avoid sending relatively
unimportant messages. Debug or Info priority level messages are generally only useful for debugging
operations. By setting a filter mask, a process can improve performance by avoiding spending time
sending messages that are in most cases unnecessary.
The -c option may be used to control filtering. In addition to the internal filter value that pro-cesses processes
cesses may set as described above, the system maintains a global ``master'' filter. This filter is
normally ``off'', meaning that it has no effect. If a value is set for the master filter, it overrides
the local filter for all processes. Root user access is required to set the master filter value.
The current setting of the master filter mask may be inspected using:
syslog -c 0
The value of the master filter mask my be set by providing a second argument following -c _. The value
may a set of characters from the set ``pacewnid''. These correspond to the priority levels Emergency
(Panic), Alert, Critical, Error, Warning, Notice, Info, and Debug. The character ``x'' may be used for
Error, as it is used for sending messages. The master filter may be unset with:
syslog -c 0 off
Since it is common to use the filter as a ``cutoff'' mechanism, for example to cut off messages with
Debug and Info priority, a single character from the list above may be specified, preceded by a minus
sign. In this case, syslog uses a filter mask starting at level 0 (Emergency) ``up to'' the given
level. For example, to set the master filter level to cause all processes to log messages from Emer-gency Emergency
gency up to Debug:
syslog -c 0 -d
While the master filter level may be set to control the messages produced by all processes, another
filter mask may be specified for an individual process. If a per-process filter mask is set, it over-rides overrides
rides both the local filter mask and the master filter mask. The current setting for a per-process
filter mask may be inspected using -c process, where process is either a PID or the name of a process.
If a name is used, it must uniquely identify a process. To set a per-process filter mask, an second
argument may be supplied following -c process as described above for the master filter mask. Root
access is required to set the per-process filter mask for system (UID 0) processes.
The filtering described above takes place in the client library to determine which messages are sent to
the syslogd daemon. The daemon also contains filters which determines which messages are saved in the
data store. This determines which messages are seen when reading messages using the syslog utility, or
when viewing data store messages in the Console utility application.
The default data store filter mask permits all messages with priority levels from Emergency to Debug
(level 0 to 7). The level may be inspected using:
syslog -c syslogd
To set the data store filter mask, an second argument may be supplied following -c syslog as described
above. For example, to save messages with priority level Error or less in the data store:
syslog -c syslog -e
The syslogd server also follows filtering rules specified in the /etc/asl.conf file. When the remote-control remotecontrol
control mechanism is used to change the filter of a process, syslogd will save any messages received
from that process until the remote-control filter is turned off. It is no longer necessary to adjust
the filtering for both a process and for syslogd to have messages saved in the ASL data store.
SEE ALSO
syslogd(8), logger(1), asl(3), syslog(3),
HISTORY
The syslog utility appeared in Mac OS X 10.4.
Mac OS X October 18, 2004 Mac OS X
|
The way to report a problem with this manual page depends on the type of problem: