I used to be able to use the Console on macOS to examine iOS device issues, and identify system issues that were causing problems with my app. The volume of logs generated with more recent versions of iOS is so large that the logs are basically useless. If I'm using Console to stream the log on macOS then it holds no more than a few seconds of data before is starts throwing away old lines. If I use sudo log collect --size <size>m --device-udid <UDID> I can specify a max of 999m, and that runs out in 5 seconds on average. Can't specify 'g' as an option for size :-( There doesn't appear to be a way to exclude logging information I don't need or to stream the log to a file with more than a 999 MB capacity. Is there some way to do this? I have a hard time believing that all this logging would be happening with no effective way to access it over longer times. Or maybe someone did just really mess up the logging system with current releases...

If I write: Logger().log("Log this value: \(myInstanceProperty)") I get "Reference to property 'myInstanceProperty' in closure requires explicit use of 'self' to make capture semantics explicit." This seems to imply an escaping autoclosure, which means we must guard against retaining self. Is this correct or is it safe to include a strong self here?

I am new to DriverKit and have been experimenting with the DriverKit sample code as well as my own test driver. My current task is learning how to observe debug messages from the driver's os_log invocations. This has been frustrating because at one point I was able to see my driver's debug messages in the Console app, but now they are not appearing no matter what I try, and I have no idea what changed. This is happening with both my own driver and Apple's samples, so I suspect the drivers are instantiating correctly -- request:didFinishWithResult: indicates success -- and calling os_log in Start, but I am just not able to see the messages in Console for some reason. I have both "Include Info Messages" and "Include Debug Messages" checked in Console's Action menu. My problem is very similar to this previous post, but I tried the author's suggested tweak to the os_log macro and it didn't help me. My specific questions are: Why does DriverKit have its own log.h that is missing significant functionality? In particular, the os_log_type enum contains only OS_LOG_TYPE_DEFAULT, which means I cannot adjust the severity level of my logs. In particular, I cannot log a message at the error level (OS_LOG_TYPE_ERROR). This would be helpful in eliminating the possibility that my problem is due to some kind of severity level filtering. Is there anything else I can do to troubleshoot this problem? I have exhausted all my troubleshooting ideas. Thanks

The unified logging system on iOS can allegedly be configured by means of configuration profiles (as alluded to e.g. here), but documentation as to how to do that seems to be scarce. I am especially interested in whether it is possible to create a profile that auto-expires after a predefined time period (as the one for use with Apple Pay available here does). Can anyone point me in the right direction?

This is probably a minor point because it wouldn't affect distributed binaries, but I thought I'd mention it in case the behavior is unexpected. After watching WWDC 20202 Explore logging in Swift, I tried some simple examples in a Mac command-line app. I was surprised to see the strings were all printed just fine. There was no redaction. At least when running the program from Xcode. (Even using the old os_log() approach showed the strings without needing to add %{public}@.) However, if I run the program from a Terminal shell, the string arguments are properly redacted. I actually like this behavior (showing more while running in Xcode), but I thought I'd just raise the issue. Sample code and screenshot from Console are shown below. import Foundation import os let logger = Logger(subsystem: "com.example.logging_test", category: "hello") let greeting = "Hello" let personName = "World" logger.log("\(greeting), \(personName)") logger.log("\(greeting, privacy: .private), \(personName)") logger.log("\(greeting, privacy: .public), \(personName)") os_log("%@, %@", greeting, personName)

Hello, I have 2 problems currently tied to instruments on xcode 14.2 The first one: i currently use macbook pro 13' with intel processor and a mac mini M1. i am doing some signpost logging to measure my app performance on certain app lifetime period. The logging code is currently working in Macbook pro with intell processor, showing time spans of the intended signpost record. But with the same code, i cannot see result when i run it on Mac mini M1. The second one: Is about the instument settings. In intel macbook, the instument settings have CPU tab where i can limit my CPU core used for instrumentation. But on mac mini M1, i don't see any CPU tab on instrument setting, is this expected? ---will edit later--- img: Intel result img: mac mini M1 result ---will edit later--- img: Intel instument settings img: M1 Instrument settings

Is there an API to create a .logarchive file from the contents of e.g. a OSLogStore?

We have been noticing some mysterious port binds on our macos setups, where the syslogd process binds to a ephemeral port on UDP. This socket isn't bound from the time syslogd process starts, but something/ some event triggers this bind. So we investigated further. It appears that one of the macos specific modules in syslogd is the "bsd_out" module which reads the config rules from a file called "/etc/syslog.conf". The contents of that file on my setup are: cat /etc/syslog.conf # Note that flat file logs are now configured in /etc/asl.conf install.* @127.0.0.1:32376 These contents are the default ones shipped in macos and nothing has been edited/changed. So it appears that the bsd_out module has been configured with a rule to send logs/messages in the "install" facility to be forwarded to some process which has a socket listening on loopback's 32376 port. Whenever some software gets installed/uninstalled from the machine, it looks like a log message gets generated which falls under this "install" facility and then the bsd_out module binds a socket for UDP and uses that socket to send the data to 127.0.0.1:32376. You will notice that before installing/uninstalling any software the command: sudo lsof -p &lt;syslogd-pid&gt; will not list any UDP port. As soon as you install/uninstall something that socket gets bound and is visible in the output of the above command. The (bound) socket stays around. The curious part is there's still no one/nothing that listens on that 32376 port. So it appears that this module is sending some datagrams that are just lost and not delivered? Is there a reason why the /etc/syslog.conf has this rule if there's nothing that's receiving that data? The "man syslogd" page does state that bsd_out module is only there for backward compatibility, so perhaps this config rule in /etc/syslog.conf is just a left over that is no longer relevant? I'm on macos 13.2.1: sw_vers ProductName: macOS ProductVersion: 13.2.1 BuildVersion: 22D68 but this has been noticed on older version (even 10.15.x) too. To reproduce, here are the steps: Find the pid of syslogd (ps -aef | grep syslogd) Find the resources used by this process including ports (sudo lsof -p &lt;syslog-pid&gt;) At this point, ideally, you shouldn't see any UDP ports being used by this process Install/uninstall any software (for example: move to trash and delete any installed application) Run the lsof command again (sudo lsof -p &lt;syslog-pid&gt;), you will now see that it uses a UDP port bound to INADDR_ANY address and an ephemeral port: syslogd 12345 root 11u IPv4 0xf557ad678c99264b 0t0 UDP *:56972 netstat output too will show that port (for example: netstat -anv -p UDP)

Afternoon Apple Fourms,I'm exploring the features of os_log for my team, and from reading the documentation and playing around an example project it seems to me that there isn't a support way to enable/disable log levels at all on iOS devices for subsystems or their categories The documentation suggest that there is a way to do this macOS using both a command line tool or by installing a plist:https://developer.apple.com/documentation/os/logging?language=objc"Logging behavior is normally governed by the system. However, while debugging in macOS, you can enable different logging levels for a subsystem using the log command-line tool’s config argument while logged in as root. See Listing 5, which shows how to enable debug-level logging for a subsystem.""You can also override the logging behavior of a specific subsystem by creating and installing a logging configuration profile property list file in the /Library/Preferences/Logging/Subsystems/ directory."To my knowledge, neither of these will work for iOS as you can't shell into the device, or install to the Library. Am I correct that there is no way to alert the configuration on the device? For example If I want debug logs for one category, but default on another?Ex Default-Options: Level:InfoCat1: Level:DebugCat2: Level:DefaultThanks.

I'm trying to use OSSignposter to capture intervals in our app for use in Instruments. The sample code here works in a new project. I see the intervals, signpost icons, etc. However, this same code (integrated into a much bigger app) does not record or display ANY intervals. I can get the config status on both apps' oslog configuration, and there's no difference. sudo log config --status --subsystem **.*******.*******.signposttest Mode for '**.*******.*******.signposttest' INFO PERSIST_DEFAULT I've checked both workspaces and schemes. There is no difference between these projects. The only thing I can think of at this point is a build setting that could affect it. (I'm not using OS_ACTIVITY_MODE = disable but have during the lifetime of this app). Perhaps it's a provision profile issue? Entitlements? However, I've tried profiling in debug mode with debug provision profile and got the same results. Not seeing any signpost activity is happening in immediate mode and deferred mode. I see events in the bottom pane in "List: Events" view. In the last n seconds mode, there is no data, no lanes, and nothing on the timeline. Here's the sample code. I tried in both projects. import os.signpost class AppDelegate: UIResponder, UIApplicationDelegate { var window: UIWindow? var blackWindow: UIWindow? var alertWindow: UIWindow? static var originalAppDelegate: AppDelegate! var signposter: OSSignposter var signpostInterval: OSSignpostIntervalState? override init() { signposter = OSSignposter(subsystem: Bundle.main.bundleIdentifier ?? "unknown", category: "app") signposter.emitEvent(#function) } func applicationWillResignActive(_ application: UIApplication) { guard let interval = signpostInterval else { assertionFailure("no interval") return } print("backgrounding, ending active state") signposter.endInterval("active", interval) } func applicationDidBecomeActive(_ application: UIApplication) { signpostInterval = signposter.beginInterval("active") } } Working This is what I expect to see, signposts and intervals. Not Working However, this is the sample code run in the non-working project. If I programmatically check if the OSSignposter is enabled, I get false. I have no idea how this has been disabled externally, as I'm not explicitly disabling OSSignposter. I also do not see a way to programmatically enabled it. signposter = OSSignposter(subsystem: Bundle.main.bundleIdentifier ?? "unknown", category: "app") assert(signposter.isEnabled) This always asserts. Any help would be very much appreciated.

I couldn't find anything too recent, but everything seems to say that no, asl_search-like APIs are non-existent for os_log. And the source code for log isn't available so I can't see how it does it...

When i try to get the console logs from device by connecting it to xcode, i only get last few hours logs. How do i get the console logs for atleast last 24 hours.

When I set breakpoints on os_log statements like below: os_log_debug(OS_LOG_DEFAULT, "hi"); //&lt;--break point RIGHT on this line…. I have to click the "Continue Program Execution" button three times to actually continue program execution. At first I thought my method was being called multiple times unexpectedly but it’s not. I just have to keep hitting the continue program execution button. I’m not hitting “Step over” or “step into”. I’m hitting the “Continue Program Execution” button. FB9792745

Overview: I am logging some messages using Logger I would like these messages to be printed on to Xcode without the timestamp and other details I want only the message to be displayed Questions: How can I display only the message on the Xcode console (see preferred output)? Is there a setting in Xcode to remove the timestamp prefix? Is there an alternate approach? Note: I need to use Logger because this app would be released, so print is not an option. Example Code import SwiftUI import os struct ContentView: View { let logger = Logger(subsystem: "MyApp", category: "MyCategory") var body: some View { Text("Hello, world!") .onAppear { logger.debug("content view displayed") } } } Actual Output: 2022-11-25 18:41:10.116408+0800 Demo[36175:5518724] [MyCategory] content view displayed Preferred Output: One of the following would be ideal: content view displayed Demo[36175:5518724] [MyCategory] content view displayed My Failed Attempt I event tried to use print in debug mode, but couldn't make it compile: Following is my failed attempt: import os #if DEBUG struct Logger { let subsystem: String let category: String func debug(_ message: String) { print(message) } //This will not help: // func debug(_ message: OSLogMessage) { // print(message) // } } #endif

It's very nice that I can enumerate the entries in my application logs. I've used NSPredicate to great effect over the past few decades. To use it most effectively, however, you need to know what keys an object has. I have not yet found any documentation which tells you what keys (and their value types) that you can use in the NSPredicate you pass to getEntries(with:at:matching:) By trial and error (ok... mostly trial and assumption). I found I can use "subsystem = %@". I might assume things like category and date are in there. How about log level? Are the available keys and associated value types documented?

I am new to Mac Os kext development. I want to develop a device driver on macOS Mojave (10.14.2) for my device. I created a demo to check the running process of the driver, but after actually running it, I didn't find any log about the driver. The following is the source code. Compile with xcode. IOKitTest.cpp /* add your code here */ #include "IOKitTest.hpp" #include <IOKit/IOService.h> #include <IOKit/IOLib.h> // 类似cocoa中 super关键字 #define super IOService // 和头文件中的宏定义类似, 自动生成一些特定的代码 OSDefineMetaClassAndStructors(com_apple_driver_IOKitTest, IOService); bool com_apple_driver_IOKitTest::init(OSDictionary *dict) {   bool result = super::init(dict);       IOLog("IOKitTest : did init !! \n"); // IOlog() 生成log日志, 存在在system.log里       log = os_log_create("com.apple.driver", "XmX");   os_log(log, "xmx Tests!!");       /** 遍历OSDictionary */   OSCollectionIterator *iter = OSCollectionIterator::withCollection(dict);   if (iter)   {     OSObject *object = NULL;     while ((object = iter->getNextObject()))     {       OSSymbol *key = OSDynamicCast(OSSymbol, object);       IOLog("iRedTest : key:%s ",key->getCStringNoCopy());       OSString *value = OSDynamicCast(OSString, dict->getObject(key));       if (value != NULL)       {         IOLog("iRedTest : value:%s\n",value->getCStringNoCopy());       }     }   }       return result; } void com_apple_driver_IOKitTest::free(void) {   IOLog("IOKitTest : free \n");   os_log(log, "xmx Tests!!");   super::free(); } IOService *com_apple_driver_IOKitTest::probe(IOService *provider, SInt32 *score) {   IOService *probe = super::probe(provider, score);   return probe; } bool com_apple_driver_IOKitTest::start(IOService *provider) {   bool result = super::start(provider);   IOLog("IOKitTest : start \n");   os_log(log, "xmx Tests!!");   return result; } void com_apple_driver_IOKitTest::stop(IOService *provider) {   IOLog("IOKitTest : stop \n");   os_log(log, "xmx Tests!!");   super::stop(provider); } IOKitTest.hpp /* add your code here */ #include <IOKit/IOService.h> #include <os/log.h> #ifndef IOKitTest_hpp #define IOKitTest_hpp class com_apple_driver_IOKitTest : public IOService {       //一个宏定义，会自动生成该类的构造方法、析构方法和运行时   OSDeclareDefaultStructors(com_apple_driver_IOKitTest);     public:   // 该方法与cocoa中init方法和C++中构造函数类似   virtual bool init(OSDictionary *dict = 0) APPLE_KEXT_OVERRIDE;   // 该方法与cocoa中dealloc方法和c++中析构函数类似   virtual void free(void) APPLE_KEXT_OVERRIDE;   // 进行驱动匹配时调用   virtual IOService *probe(IOService *provider, SInt32 *score) APPLE_KEXT_OVERRIDE;   // 进行加载时调用   virtual bool start(IOService *provider) APPLE_KEXT_OVERRIDE;   // 进行卸载时调用   virtual void stop(IOService *provider) APPLE_KEXT_OVERRIDE;       os_log_t log; }; #endif /* IOKitTest_hpp */ info.plist <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>CFBundleDevelopmentRegion</key> <string>$(DEVELOPMENT_LANGUAGE)</string> <key>CFBundleExecutable</key> <string>$(EXECUTABLE_NAME)</string> <key>CFBundleIdentifier</key> <string>$(PRODUCT_BUNDLE_IDENTIFIER)</string> <key>CFBundleInfoDictionaryVersion</key> <string>6.0</string> <key>CFBundleName</key> <string>$(PRODUCT_NAME)</string> <key>CFBundlePackageType</key> <string>KEXT</string> <key>CFBundleShortVersionString</key> <string>1.0</string> <key>CFBundleVersion</key> <string>1</string> <key>IOKitPersonalities</key> <dict> <key>IOKitTest</key> <dict> <key>CFBundleIdentifier</key> <string>com.apple.driver.IOKitTest</string> <key>IOClass</key> <string>com_apple_driver_IOKitTest</string> <key>IOMatchCategory</key> <string>com_apple_driver_IOKitTest</string> <key>IOProbeScore</key> <integer>10000</integer> <key>IOProviderClass</key> <string>IOResource</string> <key>IOResourceMatch</key> <string>IOKit</string> </dict> </dict> <key>NSHumanReadableCopyright</key> <string>Copyright © 2022 JingCe. All rights reserved.</string> <key>OSBundleLibraries</key> <dict> <key>com.apple.kpi.iokit</key> <string>18.2.0</string> <key>com.apple.kpi.libkern</key> <string>18.2.0</string> </dict> </dict> </plist> After the driver is loaded kextstat shows Does the above indicate that the driver is loaded successfully? where to view the kernel log？ Where can I learn kext demo？

We created Driver sample by Xcode template and following macro was added into code: #define Log(fmt, ...) os_log(OS_LOG_DEFAULT, "Driver - " fmt "\n", ##__VA_ARGS__) We used this macro in init and start. For example: bool ForcePlateDriver::init() { Log("init()"); But our logs are not displayed in Console app. Did we miss something? Is anything else is required to have logs for Driver? Our environment: MacOS Monterey - 12.4 (21F79) Xcode - Version 13.4 (13F17a)

I'm using the Swift Logger struct to log messages at startup of an iOS application. Not infrequently log messages are dropped that I know must have been logged. Below I include two screenshots from Console.app that were taken from the same build of the application. In both circumstances the application was launched into the background via a push notification with available content. The first screenshot contains all of the logs that I expected. In the second screenshot we see that the initialization log does not appear, even though I know that the object was initialized. I am using the logger as follows: let logger = Logger(subsystem: "com.mysubsystem", category: "cat") logger.log(level: .default, "view did load") I've wondered if I see dropped messages because lots of logs are being triggered at app startup. Is there a buffer size I can increase within Logger, or another way to debug why some log messages are not coming through?

I integrated OSLogStore in my app to be able get logs from users when they have an issue. However I faced several issues with the current logic and documentation, that I will mention below. Logs disappear I used the methods in the documentation: let store = try OSLogStore(scope: .currentProcessIdentifier)             let date = Date().addingTimeInterval(-24 * 3600)             let position = store.position(date: date)             entries = try store                 .getEntries(at: position)                 .compactMap { $0 as? OSLogEntryLog }                 .filter { $0.subsystem == Bundle.main.bundleIdentifier! } It returns logs, but if I trigger the method second time after an hour and having an app in background the old logs disappear. Based on the variable position the logs should still be retrieved. In addition there is not mentioned how many entries can be retrieved via getEntries method in documentation. So my question is when the logs are removed and are not available? (in the example I had only few logs generated and it still was not able to retrieve them after an hour, when I triggered the method getEntries ) Is there any buffer limit? Here is my example implementation where you can reproduce the issues mentioned above.. example of integration for iOS

Hi, I need to retrieve the app logs in a file to be sent via API only when needed. I write the logs and recover them but only of the current instance! If the app crashes or is closed, the old logs are deleted while I have to recover them at the next start. I write log with Logger and recover them with OSLogStore. here a sample snippet to write func testLog(_ message: String){    let logger = Logger(subsystem: Bundle.main.bundleIdentifier!, category: "myAppLog")    logger.error("Sample error msg")   } and the snippet to load  func getLogEntries() throws -> [OSLogEntryLog] {     let logStore = try OSLogStore(scope: .currentProcessIdentifier)     let oneDayAgo = logStore.position(date: Date().addingTimeInterval(-3600*24))     let allEntries = try logStore.getEntries(at: oneDayAgo)     return allEntries       .compactMap { $0 as? OSLogEntryLog }       .filter { $0.subsystem == Logger.subsystem }   } any clue?