Getting Syslog working on OSX Monterey

[Barry Scott]

> On 3 Mar 2022, at 03:01, Philip Bloom <philip.bloom at applovin.com> wrote:
> 
> I'm probably asking on the wrong list, and probably should bother wherever apple's ASL experts live for changes in monterey.   Guess nobody else is seeing this?
> 
> The same exact code is working just fine on OSX Big Sur, but on OSX Monterey it doesn't work at all.  Users that haven't updated are having the program produce logs as it has for years through logging.handlers.SysLogHandler.  Mac OSX definitely has a listening socket at '/var/run/syslog' which shows up in Console.app.
> 
> Apologies, Barry.  I'm not quite understanding your responses.  

This works:

    syslog.openlog(logoption=syslog.LOG_PID, facility=syslog.LOG_USER)
    syslog.syslog(syslog.LOG_NOTICE, 'QQQ test log')

I see the "QQQ test log" when I run syslog command.

And I can reproduce that logging.handlers.SysLogHandler does not work.
I added debug to the SysLogHandler() code and see that it does indeed write into the /var/run/syslog socket.
I suspect that macOS /var/run/syslog does not implement the RFC that this code depends on, but that a wild guess.

I suggest that you write your own handler that uses syslog.syslog() and use that.

Barry

> 
> When we say OSX has no listener for Syslog, what is the Apple System Log and the general output to Console.app then?  I thought that was the local syslog on OSX and had, for years, been behaving as such when using logging.handlers.SysLogHandler with a config in /etc/asl/ to define how it should be routed and the rollover/cleanup frequency.  
> 
> Thanks for replying, just having trouble understanding.
> 
> 
> On Mon, Feb 28, 2022 at 2:07 PM Barry Scott <barry at barrys-emacs.org <mailto:barry at barrys-emacs.org>> wrote:
> 
> 
> > On 28 Feb 2022, at 21:41, Peter J. Holzer <hjp-python at hjp.at <mailto:hjp-python at hjp.at>> wrote:
> > 
> > On 2022-02-27 22:16:54 +0000, Barry wrote:
> >> If you look at the code of the logging modules syslog handle you will see that
> >> it does not use syslog. It’s assuming that it can network to a syslog listener.
> >> Such a listener is not running on my systems as far as I know.
> >> 
> >> I have always assumed that if I want a logger syslog handler that I would have
> >> to implement it myself. So far I have code that uses syslog directly and have
> >> not written that code yet.
> > 
> > What do you mean by using syslog directly? The syslog(3) library
> > function also just sends messages to a "syslog listener" (more commonly
> > called a syslog daemon) - at least on any unix-like system I'm familiar
> > with (which doesn't include MacOS). It will, however, always use the
> > *local* syslog daemon - AFAIK there is no standard way to open a remote
> > connection (many syslog daemons can be configured to forward messages to
> > a remote server, however).
> 
> I'm re-reading the code to check on what I'm seeing. (Its been a long
> time since I last look deeply at this code).
> 
> You can write to /dev/log if you pass that to
> SysLogHandler(address='/dev/log'), but the default is to use a socket
> to talk to a network listener on localhost:514. There are no deamons
> listening on port 514 on my Fedora systems or mac OS.
> 
> That is not what you would expect as the default if you are using the C
> API.
> 
> What you do not see used in the SyslogHandler() is the import syslog
> and hence its nor using openlog() etc from syslog API.
> 
> Barry
> 
> 
> 
> >        hp
> > 
> > -- 
> >   _  | Peter J. Holzer    | Story must make more sense than reality.
> > |_|_) |                    |
> > | |   | hjp at hjp.at <mailto:hjp at hjp.at>         |    -- Charles Stross, "Creative writing
> > __/   | http://www.hjp.at/ <http://www.hjp.at/> |       challenge!"
> > -- 
> > https://mail.python.org/mailman/listinfo/python-list <https://mail.python.org/mailman/listinfo/python-list>
> 
> -- 
> https://mail.python.org/mailman/listinfo/python-list <https://mail.python.org/mailman/listinfo/python-list>
> 
> 
> -- 
> Philip Bloom
> Director, Services Engineering
> AppLovin Corporation
> M: (786)-338-1439 <tel:786-338-1439>  
>  <https://www.linkedin.com/company/applovin>  <https://twitter.com/AppLovin>  <https://facebook.com/AppLovin>  <https://www.instagram.com/applovin/>
>  <https://www.applovin.com/>
> 
> 
>