[syslog-ng] No logging on Snow Leopard except internal

[Andrew Eberbach]

Yup, that was the result of my research and experimentation as well. I just thought I'd missed something obvious. 

Thanks,
Andrew Eberbach

On 2012-01-17, at 4:47 AM, Pal Tamas <folti at balabit.hu> wrote:

> On Tue, Jan 17, 2012 at 08:58:19AM +0100, Balazs Scheidler wrote:
>> On Mon, 2012-01-16 at 17:07 -0500, Andrew Eberbach wrote:
>>> Hi
>>> 
>>> Yeah I figured as much. I guessed that Darwin would be FreeBSD-ish so
>>> I added that to the script but it didn't work. On OSX there's no
>>> /dev/log. I did an lsof|grep syslogd to see what it had open:
>>> 
>>> /var/run/asl_input
>>> /var/run/syslog
>>> /dev/klog
>>> 
>>> But none of those seemed to get the log messages. What I ended up
>>> doing is just forwarding everything through to syslog-ng over UDP from
>>> normal syslogd but that doesn't seem like it's The Right Way (tm).
>>> 
>>> Anyway, thanks for getting back to me. If you do figure out a way to
>>> do it without having to have both running I'd be interested.
>> 
>> It'd make sense to post what configuration you've tried.
>> 
>> According to the page below [1], it should be:
>> 
>> unix-dgram("/var/run/syslog");
>> 
>> Does that work for you?
>> 
>> [1] http://72.14.189.113/howto/logging/syslog-ng/
> That article is outdated. From 10.4 OS X uses the new Apple System
> Logger infrastructure to collect and store logs in an internal database.
> It's format is proprietary and only accessable by an API (see asl(3) and
> asl.conf(3)).
> 
> What Apple's syslogd does it to poll this database periodically over
> said API and write the selected logs into the ye olde text files.
> 
> As long as syslog-ng doesn't have a source plugin for ASL, the only
> thing can be done is configure syslogd to send logs over UDP or a pipe
> to syslog-ng.
> 
> Regards,
> folti
> 
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>