Apple System Log data life-cycle manager
aslmanager [-s store_dir] [-a [archive_dir]] [-ttl days] [-store_ttl days]
[-module_ttl days] [-size max_size] [-asldb]
[-module [name]] [-checkpoint] [-d [level]] [-dd [level]]
Started by syslogd, manages rotated files and ASL data written by the syslogd server, .
/etc/asl which may be overridden by command-line options .
First checks the ASL database in
/var/log/asl, then files and directories specified by
/etc/asl.conf and each ASL output module.
|only the ASL database will be processed.
| ASL database will not be processed. All ASL output modules, or a single module if name is specified, will be processed.
| signal syslogd to checkpoint files for all modules, or for a single named module, before processing.
|output debug messages, 3 causing the most detail.. default: 1.
| dry run ,no modifications are made
f for store_path.
scans the ASL database in
parameter in asl.conf, or path supplied.
for the entire database the |
max_store_size parameter in
asl.conf, or as
specified. Causes archival and removal files to keep the database size below the specified limit. Default : 150 MB.
Files are removed in order starting from oldest to newest. Files with the same date are removed in
standard lexicographic order.
|use days (time_to_live)to retain filesD |
Files older than the time-to-live are either archived or removed.
Files that contain messages with explicit expire times are removed or
archived monthly after all their contents expire.
The default 7 day time-to-live value may be overridden by the setting
of the ``store_ttl'' parameter in asl.conf or by supplying a value following the -store_ttl flag or the -ttl flag (which
overrides the time-to-live for both the ASL database and for all ASL modules).
A time-to-live value of zero allows files to remain in the store with no time limit.
|Files are either removed entirely or copied to an archive directory. If the -a flag is specified with no argument, files
are copied to the /var/log/asl.archive directory. An alternate directory path may be specified following the -a flag.
The archive parameter setting in asl.conf enables or disables archiving. The archive parameter requires a value of "1"
to enable archiving, or a value of "0" to disable it. An option archive directory path may follow the "0" or "1".
ASL OUTPUT MODULE MANAGEMENT
|, aslmanager first locates all
For each ASL output module, or a single module specified as an argument following
checkpoint files produced by syslogd for that module. aslmanager checks all ASL directory data stores and all rotated
log files - those with a ``rotate'' option in the module's configuration rules. Checkpoint files are renamed if necessary to conform to the naming style specified for the file by a ``style'' option in the module's configuration file.
aslmanager will compress the file if directed by a ``compress'' option, and it will move the file to a destination direc-
tory if a ``dest'' option is specified for the file. Following this, aslmanager will delete expired files. The time-to-
live for files is 7 days by default, but may be specified using the ``ttl'' option for the file in the module's configu-
ration rules. If -module_ttl or -ttl are specified command line, then value specified as an argument is used as a time-
to-live instead. -module_ttl specifies time-to-live for module processing. -ttl specifies time-to-live for both the ASL
database and for modules.
``all_max'' total size of all the rotated
versions, and will delete them, (oldest first) to limit the total size as specified by ``all_max''. When processing ASL
directory data stores, aslmanager will similarly delete data files after the expiry of their time-to-live, and will
delete data files (oldest first) to limit the total size as specified by ``all_max''.
syslogd(8), syslog(1), asl(3), asl.conf(5), syslog(3).