January 27, 2010

Why your syslog events don’t show up under Console.app

Filed under: ResearchAndDevelopment — Ryan Wilcox @ 12:21 am

Tonight I was debugging something for a client. Our Rails app uses SyslogLogger to log to syslog (instead of the files in log/*.log, like Rails is set up by default. We think there are some wins using syslog).

I was trying to debug why some logging statements would show up, and some didn’t. In fact, logger.info and logger.debug weren’t working for us. These correspond, by default, to syslog log levels info and debug (oddly enough).

This blog entry will explain how what settings you need to tweak to have Console.app display things at a higher log level. To see log level debug in Console.app. (Yes, this is the part of the article where I input search terms I used in trying to find this information, so some other sod can find it too.)

Syslog is one of those unix components that Apple pulled the guts out of and left a small shell that’s compatible with the rest of Unix. Domain of the Bored has an excellent series of articles on ASL. There’s also some really good documentation from an (I’m guessing) Apple engineer on the darwin-dev mailing list on ASL.

So great. ASL controls syslog. If ASL says something isn’t stored, syslog doesn’t ever see it – even if it was a log level syslog would normally care about.

We need to add an entry to asl.conf. man asl.conf gives us syntax, etc. All we want to do is capture all log levels for our app, rails_app_mine.

edit /etc/asl.conf with your favorite editor. Add the following line:

? [<= Level debug] [= Sender rails_app_mine] store
Sender is the syslog process. We set this in our Rails app by creating the SyslogLogger object like so:

config.logger = RAILS_DEFAULT_LOGGER = SyslogLogger.new("rails_app_mine")

Now syslog will see your lines, and you can configure syslog using normal syslog mechanisms (like sending your rails_app_mine messages to a syslog server, or syslog-ng, let's say).

Alternatively, in /etc/asl.conf you could modify the line

? [<= Level notice] store

to instead read

? [<= Level debug] store

but that would log ALL debug statements, including ones that we really don't care about. And seriously, there's too much spew in Console.app already.

Make this change and reload syslog by having launchd reload it (no, -HUP-ing it doesn't work):


sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist; \
sleep 1;\
sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist

And you're done.