syslog -modules
% syslog -module
ASL out module: com.apple.asl [current status: enabled]
output /var/log/appfirewall.log
rules: 1
dest: (none)
format: std
time_format: lcl
flags: 0x00004008 (coalesce)
ttl: 7 days
mode: 0644
file_max: 5242880
all_max: 52428800
uid: 0
gid: 80
output /var/log/system.log
rules: 4
dest: (none)
format: bsd
time_format: lcl
flags: 0x0000401c (rotate coalesce compress)
rotatation style: [base=system].[ext=log].
ttl: 7 days
mode: 0640
file_max: 5242880
all_max: 52428800
uid: 0
gid: 80
output /var/log/asl
rules: 2
dest: (none)
format: std
time_format: lcl
flags: 0x00002000 (asl_directory)
ttl: 7 days
mode: 0755
file_max: 0
all_max: 0
uid:
gid:
output /var/log/asl/Logs/aslmanager
rules: 0
dest: (none)
format: std
time_format: lcl
flags: 0x0000404c (rotate coalesce external)
rotatation style: [base=aslmanager].
ttl: 2 days
mode: 010000
file_max: 0
all_max: 0
uid:
gid:
access Q [= Facility authpriv] 0 80
access Q [= Facility remoteauth] [<= Level 2] 0 80
broadcast Q [= Level 0]
store Q [<= PID 1]
ignore Q [= Facility internal]
store Q [<= Level 5]
file Q [= Sender kernel] system.log
file Q [<= Level 5] system.log
file Q [= Facility auth] [<= Level 6] system.log
file Q [= Facility authpriv] [<= Level 6] system.log
file Q [= Facility com.apple.alf.logging] appfirewall.log file_max=5M all_max=50M
ASL out module: com.apple.mkb.internal [current status: disabled]
output /private/var/log/keybagd.log
rules: 6
dest: (none)
format: std
time_format: lcl
flags: 0x00004028 (coalesce non-std_dir)
ttl: 7 days
mode: 0644
file_max: 0
all_max: 0
uid: 0
gid: 80
set (file) Q [. /private/var/root/.mkb_debug] enable
file Q [= Sender kernel] [CA= Message SEP] keybagd.log
file Q [= Sender SpringBoard] [CSZ= Message MC:] keybagd.log
file Q [= Sender SpringBoard] [CSZ= Message secure lock screen] keybagd.log
file Q [= Sender backboardd] [CA= Message MultitouchHID] keybagd.log
file Q [= Sender profiled] keybagd.log
file Q [= Sender mdmd] keybagd.log
ASL out module: com.apple.cdscheduler [current status: enabled]
output /var/log/module/com.apple.cdscheduler/cdscheduler.log
rules: 1
dest: (none)
format: std
time_format: lcl
flags: 0x0000401c (rotate coalesce compress)
rotatation style: [base=cdscheduler].[ext=log].
ttl: 3 days
mode: 0644
file_max: 2097152
all_max: 2097152
uid: 0
gid: 80
file Q [= Sender com.apple.CDScheduler] cdscheduler.log
claim Q [= Sender com.apple.CDScheduler] [> Level 3]
ASL out module: com.apple.install [current status: enabled]
output /var/log/install.log
rules: 1
dest: (none)
format: $((Time)(JZ)) $Host $(Sender)[$(PID)]: $Message
time_format: lcl
flags: 0x00008014 (rotate compress size_only)
rotatation style: [base=install].[ext=log].
ttl: 7 days
mode: 0644
file_max: 52428800
all_max: 157286400
uid: 0
gid: 80
claim Q [= Facility install] only
file Q [. ] /var/log/install.log format='$((Time)(JZ)) $Host $(Sender)[$(PID)]: $Message' rotate=seq compress file_max=50M all_max=150M size_only
ASL out module: com.apple.authd [current status: enabled]
output /var/log/asl
rules: 1
dest: (none)
format: std
time_format: lcl
flags: 0x00002000 (asl_directory)
ttl: 7 days
mode: 0755
file_max: 0
all_max: 0
uid:
gid:
output /var/log/system.log
rules: 1
dest: (none)
format: std
time_format: lcl
flags: 0x00004008 (coalesce)
ttl: 7 days
mode: 0644
file_max: 0
all_max: 0
uid: 0
gid: 80
output /var/log/authd.log
rules: 1
dest: (none)
format: bsd
time_format: lcl
flags: 0x0000401c (rotate coalesce compress)
rotatation style: [base=authd].[ext=log].
ttl: 7 days
mode: 0640
file_max: 5242880
all_max: 20971520
uid: 0
gid: 80
claim Q [= Sender authd] only
file Q [. ] /var/log/authd.log mode=0640 compress format=bsd rotate=seq file_max=5M all_max=20M
file Q [<= Level 3] /var/log/system.log
store Q [<= Level 3]
ASL out module: com.apple.eventmonitor [current status: enabled]
output /var/log/eventmonitor
rules: 1
dest: (none)
format: std
time_format: lcl
flags: 0x00006000 (asl_directory)
ttl: 7 days
mode: 0755
file_max: 0
all_max: 0
uid: 0
gid: 80
claim Q [A= Facility com.apple.eventmonitor] only
asl_dir Q [. ] /var/log/eventmonitor
ASL out module: com.apple.coreduetd [current status: enabled]
output /var/log/CoreDuet/coreduetd.log
rules: 0
dest: (none)
format: std
time_format: lcl
flags: 0x000040dc (rotate coalesce compress external)
rotatation style: [base=coreduetd].[ext=log].
ttl: 1 day
mode: 0644
file_max: 16777216
all_max: 16777216
uid:
gid:
ASL out module: com.apple.mail [current status: enabled]
output /var/log/mail.log
rules: 1
dest: (none)
format: bsd
time_format: lcl
flags: 0x0000401c (rotate coalesce compress)
rotatation style: [base=mail].[ext=log].
ttl: 7 days
mode: 0644
file_max: 5242880
all_max: 52428800
uid: 0
gid: 80
claim Q [= Facility mail] only
file Q [. ] /var/log/mail.log
ASL out module: com.apple.login.guest [current status: disabled]
output /Users/Guest/Library/Logs/Guest.log
rules: 1
dest: (none)
format: std
time_format: lcl
flags: 0x00004828 (soft coalesce non-std_dir)
ttl: 7 days
mode: 0644
file_max: 0
all_max: 0
uid: 0
gid: 80
set enable 0
set Q [= ut_user Guest] [= ut_type 7] enable 1
set Q [= ut_user Guest] [= ut_type 8] enable 0
access Q [= UID 201] 0 80
file Q [= UID 201] /Users/Guest/Library/Logs/Guest.log soft
ASL out module: com.apple.performance [current status: enabled]
output /var/log/performance
rules: 1
dest: (none)
format: std
time_format: lcl
flags: 0x00006000 (asl_directory)
ttl: 7 days
mode: 0755
file_max: 0
all_max: 0
uid: 0
gid: 80
claim Q [A= Facility com.apple.performance] only
asl_dir Q [. ] /var/log/performance
ASL out module: com.apple.iokit.power [current status: enabled]
output /var/log/powermanagement
rules: 1
dest: (none)
format: std
time_format: lcl
flags: 0x00006000 (asl_directory)
ttl: 14 days
mode: 0755
file_max: 0
all_max: 0
uid: 0
gid: 80
claim Q [= Facility com.apple.iokit.power] only
asl_dir Q [. ] /var/log/powermanagement rotate=local ttl=14
ASL out module: com.apple.contacts.ContactsAutocomplete [current status: enabled]
output /var/log/com.apple.contacts.ContactsAutocomplete/Probes.log
rules: 1
dest: (none)
format: $(Time) $(Host) $(Sender)[$(PID):$(ThreadID)] <$((Level)(str))>: $(Function):$(Line) | $(Message)
time_format: lcl
flags: 0x00000014 (rotate compress)
rotatation style: [base=Probes]..[ext=log]
ttl: 7 days
mode: 0644
file_max: 10485760
all_max: 209715200
uid: 0
gid: 80
output /var/log/com.apple.contacts.ContactsAutocomplete/Sorting.log
rules: 1
dest: (none)
format: $(Time) $(Host) $(Sender)[$(PID):$(ThreadID)] <$((Level)(str))>: $(Function):$(Line) | $(Message)
time_format: lcl
flags: 0x00000014 (rotate compress)
rotatation style: [base=Sorting]..[ext=log]
ttl: 7 days
mode: 0644
file_max: 10485760
all_max: 209715200
uid: 0
gid: 80
output /var/log/com.apple.contacts.ContactsAutocomplete/Performance.log
rules: 1
dest: (none)
format: $(Time) $(Host) $(Sender)[$(PID):$(ThreadID)] <$((Level)(str))>: $(Function):$(Line) | $(Message)
time_format: lcl
flags: 0x00000014 (rotate compress)
rotatation style: [base=Performance]..[ext=log]
ttl: 7 days
mode: 0644
file_max: 10485760
all_max: 209715200
uid: 0
gid: 80
output /var/log/com.apple.contacts.ContactsAutocomplete/Debug.log
rules: 1
dest: (none)
format: $(Time) $(Host) $(Sender)[$(PID):$(ThreadID)] <$((Level)(str))>: $(Function):$(Line) | $(Message)
time_format: lcl
flags: 0x00000014 (rotate compress)
rotatation style: [base=Debug]..[ext=log]
ttl: 7 days
mode: 0644
file_max: 10485760
all_max: 209715200
uid: 0
gid: 80
output /var/log/com.apple.contacts.ContactsAutocomplete
rules: 0
dest: (none)
format: std
time_format: lcl
flags: 0x00004008 (coalesce)
ttl: 7 days
mode: 0750
file_max: 0
all_max: 0
uid:
gid:
claim Q [= Facility com.apple.contacts.ContactsAutocomplete] only
file Q [= Facility com.apple.contacts.ContactsAutocomplete] [= Category Debug] /var/log/com.apple.contacts.ContactsAutocomplete/Debug.log rotate=Debug.local.log ttl=7 file_max=10M all_max=200M compress fmt='$(Time) $(Host) $(Sender)[$(PID):$(ThreadID)] <$((Level)(str))>: $(Function):$(Line) | $(Message)'
file Q [= Facility com.apple.contacts.ContactsAutocomplete] [= Category Performance] /var/log/com.apple.contacts.ContactsAutocomplete/Performance.log rotate=Performance.local.log ttl=7 file_max=10M all_max=200M compress fmt='$(Time) $(Host) $(Sender)[$(PID):$(ThreadID)] <$((Level)(str))>: $(Function):$(Line) | $(Message)'
file Q [= Facility com.apple.contacts.ContactsAutocomplete] [= Category Sorting] /var/log/com.apple.contacts.ContactsAutocomplete/Sorting.log rotate=Sorting.local.log ttl=7 file_max=10M all_max=200M compress fmt='$(Time) $(Host) $(Sender)[$(PID):$(ThreadID)] <$((Level)(str))>: $(Function):$(Line) | $(Message)'
file Q [= Facility com.apple.contacts.ContactsAutocomplete] [= Category Probes] /var/log/com.apple.contacts.ContactsAutocomplete/Probes.log rotate=Probes.local.log ttl=7 file_max=10M all_max=200M compress fmt='$(Time) $(Host) $(Sender)[$(PID):$(ThreadID)] <$((Level)(str))>: $(Function):$(Line) | $(Message)'
ASL out module: com.apple.mkb [current status: enabled]
output /private/var/log/keybagd.log
rules: 3
dest: (none)
format: bsd
time_format: lcl
flags: 0x0000483c (soft rotate coalesce compress non-std_dir)
rotatation style: [base=keybagd].[ext=log].
ttl: 5 days
mode: 0644
file_max: 5242880
all_max: 20971520
uid: 0
gid: 80
claim Q [= Sender keybagd] file keybagd.log
file Q [= Sender kernel] [CA= Message AppleKeyStore] keybagd.log
file Q [= Sender UserEventAgent] [CSZ= Message LockStateNotifier] keybagd.log
file Q [= Sender kernel] [CA= Message AppleSEPKeyStore] keybagd.log
ASL out module: com.apple.MessageTracer [current status: enabled]
output /var/log/DiagnosticMessages
rules: 1
dest: (none)
format: std
time_format: lcl
flags: 0x00006000 (asl_directory)
ttl: 30 days
mode: 0755
file_max: 0
all_max: 0
uid: 0
gid: 80
claim Q [T com.apple.message.domain] only
asl_dir Q [. ] /var/log/DiagnosticMessages ttl=30
ASL out module: com.apple.networking.boringssl [current status: disabled]
output /Library/Logs/CrashReporter
rules: 0
dest: (none)
format: std
time_format: lcl
flags: 0x00004008 (coalesce)
ttl: 7 days
mode: 0755
file_max: 0
all_max: 0
uid:
gid:
output /Library/Logs/CrashReporter/com.apple.networking.boringssl.log
rules: 1
dest: (none)
format: $((Time)(local.6)) $Host $(Sender)[$(PID)] <$((Level)(str))>: $(Message)
time_format: lcl
flags: 0x00000514 (rotate compress basestamp crashlog)
rotatation style: [base=com.apple.networking.boringssl].[ext=log].
ttl: 7 days
mode: 0644
file_max: 1048576
all_max: 0
uid: 0
gid: 80
set (plist) Q [. /Library/Preferences/com.apple.networkd.plist] [= boringssl_log_debug 1] enable
file Q [= Facility com.apple.networking.boringssl] /Library/Logs/CrashReporter/com.apple.networking.boringssl.log rotate=local-basic crashlog file_max=1M compress format=$((Time)(local.6))\ $Host\ $(Sender)[$(PID)]\ <$((Level)(str))>:\ $(Message)