How to disable/ set logging level /preferences PER Mac OS X application?

Question

I find my Mac's syslogd "Cosole" logs become unusable when some badly written app (PathFinder.app in this case) incessantly spews into syslogd all day long.. I read somewhere that you could disable logging PER app by..

1. Creating an alias to the executable bundle inside the App "package", and then ONLY launching that alias FROM the terminal. The process was... Browse to /Applications/ObnoxiousLogger.app, right click, "Show Package Contents", and then Browse to...

   /Applications/ObnoxiousLogger.app/Contents/MacOS/ObnoxiousLogger

   Then you make the alias through the GUI and remember to always launch the app from that alias, again ONLY via the terminal.

   This is annoying, as you HAVE to create the alias via the Finder (symlinking doesn't work, and there is no way to create an alias via the terminal). And if it gets launched ANY other way, youre back to square one, logorrhea.. This method DID work, but for a very short amount of time.

2. It would seem you could set this via a launchctl command, or a plist variable, but this isn't an app that is opened by launchd, and launchd's documentation is so all-over the place, but I guess this is a possibility, I suppose.

3. I saw something about sending the log to /dev/null, but it wasn't clear if this was some kind of syslogd pipe, or command, or an /etc/syslogd.conf setting, or what...

Please let me know if you have a surefire way to selectively silence logging per application, or even better, increase or decrease the logging verbosity, per process / command, etc in Mac OS X.

Solution 1

You may want to look at asl.conf(5) which allows you to ignore/process log messages on quite a fine-grained level.

Something like:

? [= Sender ObnoxiousLogger] ignore

should do the trick. If you still want to see the more serious messages from the obnoxious sender, something along the lines of:

? [= Sender ObnoxiousLogger] [> Level error] ignore

might be more appropriate.

Note: after editing /etc/asl.conf, don't forget to kill -HUP your syslogd.

Solution 2

Just create a File » New Database Search…, looking for Facility contains "console" and Sender does not contain "ObnoxiousLogger", and ignore the default Console Messages database search?

---

You can use the following command to set individual log filtering levels for specific processes:

syslog -c processname -d

This will set the log level of currently running instances of processname to all messages of debug level or higher. the possible levels are each character of pacewnid: (Panic), Alert, Critical, Error, Warning, Notice, Info, and Debug.

So, to only enable logging of warning messages and higher for Finder, use:

syslog -c Finder -w

You will need to repeat this whenever you restart the process in question.

Solution 3

I am on MacOS Mojave (10.14.3) and this post was helpful to me so I want to clarify what worked for me as I have not seen it all together in a single place. In my case I wanted to filter out Microsoft OneNote messages which were constantly spamming my system.log file at a rate of 5 a second. Sample message:

Feb  3 22:52:49 MyMacMini-2 Microsoft OneNote[393]: [ACT]:[TASKSCHEDULER]:[Info]:opQueue=0x6000012d7760 after call to waitUntilAllOperationsAreFinished

So I edited /etc/asl.conf with the following rule:

# Disable Microsoft OneNote logging as is filling up system.log!
? [= Sender Microsoft OneNote] ignore

You need to add this before the line that says:

# Rules for /var/log/system.log

As otherwise it will not work. Then just restart syslogd with this command and the messages should be gone from system.log:

sudo killall -HUP syslogd

Solution 4

The proposed solution by Torsten doesn't seem to work. It seems adding those configuration to the global asl.conf doesn't have the expected effect the way the rules are handled.

A solution to this problem, I found, after I almost went berserk fighting with the main asl.conf, is to use separate asl/* configuration files for each filter. Those files must be stored in /etc/asl/

e.g. to ignore "com.example.Sender" and filter its log spam from system.log we could create a file /etc/asl/com.example.Sender with the following content:

? [= Sender com.example.Sender] claim only
* ignore

The claim only for the match (a "Sender" in the example) causes the rules in the master asl.conf to be ignored which means things won't end up in system.log.

Don't forget to restart syslogd, of course.

View more solutions

Comments

[HikeMike]

Consider accepting answers to your questions if they solve the issue by clicking the checkmark next to them, or alternatively edit your questions or comment on answers why they don't work for you.

[mralexgray]

I have similar searches setup for just stuff I want to see.. but is there any way to prevent "ObnoxiousLogger" from ever hitting the syslog facility, at all? My concern: all that chatter must be robbing at least a few cpu cycles, no?

[HikeMike]

@mralexgray Added some further research to my answer. Unfortunately, I don't have an obnoxiously logging process running right now, so I cannot perform any reliable testing. Answer is therefore primarily based on man syslog.

[porg]

Thx for asl.conf. An ObnoxiousLogger can have an even severer effect than "stealing CPU": Preventing system sleep, as those frequent disk writes continuously reset the sleep timer! My culprit is Google Chrome, both on Mac & Win. I hope it's an innocent bug. But it's hard to believe: 1) Having users online all the time is a mayor business goal, as online-time==ad-time. Tempting to achieve this by tempering with the device sleep mechanism… 2) A Chrome bug reported 2012-07-28 still not fixed.

[porg]

My system.log contains unwanted lines in this format: <date> <hostname> <sender>: <function or object id> <message> <sender> comes in different flavors: [some kind of hexadecimal id].com.google.Chrome[decimal PID] Google Chrome[decimal PID] Q.1) How do I match Google Chrome as sender within conf.asl? Used ? [= Sender <sendername>] ignore. As <sendername> I tried: Chrome, Google Chrome, "Google Chrome", com.google.Chrome, .com.google.Chrome Q.2) What's the correct commandline to notify syslogd? Used sudo kill -HUP pidOfMySylogd. What shall be the exit code? In my case it was nil.