aslmanager

Apple System Log data life-cycle manager

aslmanager [-s store_dir] [-a [archive_dir]] [-ttl days] [-store_ttl days]
          [-module_ttl days] [-size max_size] [-asldb]
          [-module [name]] [-checkpoint] [-d [level]] [-dd [level]]

Started by syslogd, manages rotated files and ASL data written by the syslogd server, .
Configuration /etc/asl.conf, /etc/asl which may be overridden by command-line options .

First checks the ASL database in /var/log/asl, then files and directories specified by /etc/asl.conf and each ASL output module.

-asldb only the ASL database will be processed.
-module ASL database will not be processed. All ASL output modules, or a single module if name is specified, will be processed.
-checkpoint signal syslogd to checkpoint files for all modules, or for a single named module, before processing.
-d 1|2|3 output debug messages, 3 causing the most detail.. default: 1.
-dd 1|2|3 dry run ,no modifications are made
-s f use f for store_path. scans the ASL database in /var/log/asl, or store_path parameter in asl.conf, or path supplied.
-size b max size for the entire database the max_store_size parameter in asl.conf, or as specified. Causes archival and removal files to keep the database size below the specified limit. Default : 150 MB. Files are removed in order starting from oldest to newest. Files with the same date are removed in standard lexicographic order.
-store_ttl d use days (time_to_live)to retain filesD b Files older than the time-to-live are either archived or removed.
Files that contain messages with explicit expire times are removed or archived monthly after all their contents expire.
The default 7 day time-to-live value may be overridden by the setting of the ``store_ttl'' parameter in asl.conf or by supplying a value following the -store_ttl flag or the -ttl flag (which overrides the time-to-live for both the ASL database and for all ASL modules).
A time-to-live value of zero allows files to remain in the store with no time limit.
-a [dir]Files are either removed entirely or copied to an archive directory. If the -a flag is specified with no argument, files are copied to the /var/log/asl.archive directory. An alternate directory path may be specified following the -a flag. The archive parameter setting in asl.conf enables or disables archiving. The archive parameter requires a value of "1" to enable archiving, or a value of "0" to disable it. An option archive directory path may follow the "0" or "1".

ASL OUTPUT MODULE MANAGEMENT

-module modname , aslmanager first locates all For each ASL output module, or a single module specified as an argument following checkpoint files produced by syslogd for that module. aslmanager checks all ASL directory data stores and all rotated log files - those with a ``rotate'' option in the module's configuration rules. Checkpoint files are renamed if necessary to conform to the naming style specified for the file by a ``style'' option in the module's configuration file. aslmanager will compress the file if directed by a ``compress'' option, and it will move the file to a destination direc- tory if a ``dest'' option is specified for the file. Following this, aslmanager will delete expired files. The time-to- live for files is 7 days by default, but may be specified using the ``ttl'' option for the file in the module's configu- ration rules. If -module_ttl or -ttl are specified command line, then value specified as an argument is used as a time- to-live instead. -module_ttl specifies time-to-live for module processing. -ttl specifies time-to-live for both the ASL database and for modules. ``all_max'' total size of all the rotated versions, and will delete them, (oldest first) to limit the total size as specified by ``all_max''. When processing ASL directory data stores, aslmanager will similarly delete data files after the expiry of their time-to-live, and will delete data files (oldest first) to limit the total size as specified by ``all_max''.

See also

syslogd(8), syslog(1), asl(3), asl.conf(5), syslog(3).