Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

10.7: Re-enable syslogd for incoming connections UNIX
I like to have all my logs in one place, so I was using syslogd's network listening on my 10.6 Server to let my router send its logs to it. After updating to 10.7 the plist was reverted to its default state, preventing what I was used to. This hint explains what to do, to get it working again.

First make a backup of the plist, then do the following:

Convert it to XML so it's editable:

sudo plutil -convert xml1 /System/Library/LaunchDaemons/com.apple.syslogd.plist

Edit the file; I used pico with this command (you can also use TextWrangler, etc.):

sudo pico /System/Library/LaunchDaemons/com.apple.syslogd.plist

You need to insert this key:
<key>NetworkListener</key>
 <dict>
        <key>SockServiceName</key>
        <string>syslog</string>
        <key>SockType</key>
        <string>dgram</string>
 </dict>
Convert the plist back to binary format: 2br sudo plutil -convert binary1 /System/Library/LaunchDaemons/com.apple.syslogd.plist

Unload and reload syslogd:

sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist
sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist


Afterwards check Console.app for incoming logs from your router, etc.

[crarko adds: I haven't tested this one.]
    •    
  • Currently 3.29 / 5
  You rated: 5 / 5 (7 votes cast)
 
[15,175 views]  

10.7: Re-enable syslogd for incoming connections | 11 comments | Create New Account
Click here to return to the '10.7: Re-enable syslogd for incoming connections' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
Re: 10.7: Re-enable syslogd for incoming connections
Authored by: Uncle Asad on Aug 03, '11 02:43:25PM

Does 'sudo defaults write com.apple.syslogd NetworkListener -dict key1 value1 key2 value2' not work? That would save you two trips through plutilů



[ Reply to This | # ]
Re: 10.7: Re-enable syslogd for incoming connections
Authored by: jaydisc on Aug 03, '11 04:44:51PM

Close. If you put the full path it works. Without the full path, it looks in the user's own preferences folder. So, the command would be:

sudo defaults write /System/Library/LaunchDaemons/com.apple.syslogd NetworkListener -dict SockServiceName 'syslog' SockType 'dgram'

And of course you still have to unload/load



[ Reply to This | # ]
Re: 10.7: Re-enable syslogd for incoming connections
Authored by: dvessel on Aug 08, '11 09:36:48AM

The above comments should be removed. I tried taking this shortcut but it completely destroyed the file. Luckily I had a back-up.

Even if it did add the new entries it wouldn't have worked. It must go under 'Sockets'. Same mistake as the posted hint.

Thanks @Frankus for the correction in the post below.



[ Reply to This | # ]
Re: 10.7: Re-enable syslogd for incoming connections
Authored by: jaydisc on Aug 08, '11 08:34:35PM

The comment was only meant to illustrate how one could use the defaults command to modify a launchd.plist. Unfortunately, there is little I can do about the original hint's accuracy. I lack the power to edit or delete it regardless.

How did it hose your file? Can you explain?



[ Reply to This | # ]
Re: 10.7: Re-enable syslogd for incoming connections
Authored by: dvessel on Aug 08, '11 10:52:07PM

It wiped the file clean but the weird thing is that I just tested the `defaults` command again on a copy of the file and it worked. It even fell within the 'Sockets' dict group so I have no idea. Something else must have been at play.

Always have a back-up.



[ Reply to This | # ]
10.7: Re-enable syslogd for incoming connections
Authored by: bankshot on Aug 04, '11 02:11:00PM

Nice hint. I'll have to experiment with this and see if it works for my needs. Since Snow Leopard, I had used syslog-ng from MacPorts to accomplish the same thing. That method still works for me in Lion, but it might be nice to stick with just one syslogd (Apple's) running if I can.



[ Reply to This | # ]
10.7: Re-enable syslogd for incoming connections
Authored by: bcamp1973 on Aug 05, '11 09:37:00AM

Which log do check to see if this is working?



[ Reply to This | # ]
10.7: Re-enable syslogd for incoming connections
Authored by: poenn on Aug 06, '11 02:45:39AM

You could try to route incoming network syslogs into a separate logfile (needs to be configured in the plist as well), but switching to ALL MESSAGES in Console.app is enough for me. I then just search for the string, i.e. Vigor for messages from the DrayTek Vigor router.



[ Reply to This | # ]
10.7: Re-enable syslogd for incoming connections
Authored by: Frankus on Aug 05, '11 10:18:31PM
I'm getting this on regular (non-server) Lion:
com.apple.launchd: (com.apple.syslogd) Unknown key for dictionary: NetworkListener
[so I'll keep digging a bit...]

[ Reply to This | # ]
10.7: Re-enable syslogd for incoming connections
Authored by: Frankus on Aug 05, '11 10:27:48PM

Fixed it; as per the man page, you need to add that block under the 'Sockets' section.

Thanks for the hint.



[ Reply to This | # ]
10.7: Re-enable syslogd for incoming connections
Authored by: maddscientist on Jul 29, '12 07:08:21AM

Great hint. Followed instructions and logging has resumed. AirPorts use facility local0, and /etc/syslog.conf contains this line:
local0.* /var/log/appfirewall.log

Problem: Despite having AirPort set to log everything at and above level 7-Debug, only a small subset of the log data viewable with AirPort Utility is appearing in /var/log/appfirewall.log && nothing below level 5-Notice appears in either location.



[ Reply to This | # ]