hoakley September 21, 2017 Macs, Technology

Blowhole command tool 3: new version should be compatible with High Sierra

I have ported my command tool Blowhole, which writes entries into the new unified log, to Swift 3.2 and built it for compatibility with both Sierra and High Sierra. It also now declares its version along with usage info.

Version 3 is available from here: blowhole3
and in Downloads above.

2Comments

Add yours

1

JT on June 28, 2018 at 6:53 pm

Hey there, thought I’d drop a reply seeing that you’re well versed in the ways of Apple’s unified logging system.

Do you know of any way to perform logging of syslog events to a remote syslog server w/ custom port? I’ve dabbled w/ the syslog command itself, with syslog.conf and the like, but ever since macOS 10.13.4, the log content that was being forwarded has since changed and no longer reports back on what we need.

I tried using Blowhole to log content straight to the unified log, but those events aren’t getting forwarded to our syslog server.

Essentially we’re looking to log terminal history to syslog, and send those events to a remote syslog server.

We’re trying to keep to stock macOS provided capabilities, and as a last resort we can consider 3rd party alternatives, but just thought I’d reach out to see if you have any ideas.

Thanks

LikeLike
- 2
  
  hoakley on June 28, 2018 at 8:50 pm
  
  Essentially, you cannot stream unified log content to anything remote. There is a log stream command (which is the basis for Console’s live log stream), but as you can get thousands of log entries every minute, it will readily swallow all the hardware and software resources you try to devote to it. At peak flows, after starting up for instance, it is not unusual to see 10,000 log entries per minute!
  What goes into the old text logs is anyone’s guess now – Apple takes little interest in them, and every time that I have tried to find anything useful there, it isn’t any more – all the important log output goes to the unified log.
  I suspect that your best bet now would be to modify an open source shell to write to your own ‘log’ files (standard macOS calls will go to the unified log), and do the whole thing yourself.
  OpenBSM might be the other alternative: that’s still there, but I know almost nothing about it.
  I hope that helps,
  Howard.
  
  LikeLike

·Comments are closed.

Share this:

Related