eslogger's --oslog option issue

I'm trying to log Endpoint Security events to os_log. I'd be grateful if someone could confirm that using the --oslog option with eslogger actually writes event data to the system log.

If I monitor with sudo eslogger exec fork exit I see events at the command line, yet if I add the --oslog option, I don't see those events when monitoring the log with sudo log stream --predicate 'subsystem == "com.apple.eslogger"'. Nor do I see them if I filter in the Console app on just the subsystem "com.apple.eslogger".

Have I missed out something with my work? Any help appreciated. Thanks.

This is working for me. Here’s what I did:

  1. On macOS 14.1.2, I enabled Full Disk Access for Terminal.

  2. I ran eslogger as you described.

  3. In another Terminal window, I started vim and then quit it. That generates event output in the eslogger window.

  4. I stopped eslogger.

  5. I ran Console.

  6. I pasted subsystem:com.apple.eslogger into the search field.

  7. I clicked “Start streaming”.

  8. Back in Terminal, I ran eslogger, this time adding --oslog.

  9. I repeated step 3.

  10. I see the log events in Console. For example:

    type: default
    time: 11:25:57.185273+0000
    process: eslogger
    subsystem: com.apple.eslogger
    category: events
    message: {…"fork"…}
    

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Hi Quinn

Thanks for the reply. I've gone through your steps twice and on both occasions as soon as I add the --oslog switch I get no ES output in the Console app.

I'm running macOS 14.2.1 (23C71)

I also ran the Console filtering for errors and faults while repeating your steps and nothing related to this appeared.

It's not a massive issue for me, but it does seem very bizarre that this does not work as expected.

eslogger's --oslog option issue
 
 
Q