Missing logs in OSLogStore

Hello,

I need to monitor the device for an activity that is not supported by ES framework. I can reliably monitor it using correct filters with log stream, for example

sudo log stream --info --style compact --predicate 'category = "X"'

But I need to provide that functionality through my application. Because of that, I made an instance of a log store, hoping I will be able to retrieve the necessary informations that way. The problem is that the messages are sometimes appearing and sometimes not. The log level I am interested in is info, which according to the docs

The system stores info-level messages in memory buffers and, without a configuration change, purges the oldest messages as those buffers fill up.

If I understand that correctly, the info messages are being written to the buffer and not the store, only sometimes reaching it. But also that should be modifiable with a configuration change? How could I make such change to always save info logs to the store and retrieve them?

I need to monitor the device for an activity that is not supported by ES framework.

You have filed an ER for that, right?

Right?

Because the contents of the system log is not an API, meaning that it could change at any time.

Please post your bug number, just for the record.

WARNING The rest of my response assumes that you’re using the system log as a short-term workaround for missing ES functionality. I don’t endorse this as a long-term solution. I don’t even guarantee it’ll work today (-:

But also that should be modifiable with a configuration change?

Probably. Make sure you don’t change this for all info events. Rather, scope this to the specific subsystem and category you care about.

As to how you change this, you can either run the log command or install a configuration profile. I have links to all the docs in Your Friend the System Log.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Missing logs in OSLogStore
 
 
Q