2

Is there any way of Filtering out messages from OS X system log?

I am looking through the log on an old MacBook running Lion.

This has an error message every 10 seconds from an obsolete service:

com.apple.launchd.peruser.503[154] (de.novamedia.VodafoneDeviceObserver[1386]): posix_spawn("/Library/Application Support/Vodafone/NML2NDeviceObserver.app/Contents/MacOS/NML2NDeviceObserver", ...): No such file or directory

The actual app is long gone, it was only the launch service that is generating error messages (for the last 5 years!)

0
2

if you just wish to hide the error messages that are cluttering up the console log, for easier readability, then this can easily be accomplished by selecting any one of the offending event messages, then click 'Ignore Sender' on the Console toolbar; those messages will then be hidden from view. the event messages are still generated, until you fix the obsolete driver issue, but you won't see them in the Console. see more info HERE and HERE.

1
  • This looked promising but the 'Ignore Sender' is greyed out. I probably wouldn't make sense to block launchd. The error message is com.apple.launchd.peruser.503[154] (de.novamedia.VodafoneDeviceObserver[1386]): posix_spawn("/Library/Application Support/Vodafone/NML2NDeviceObserver.app/Contents/MacOS/NML2NDeviceObserver", ...): No such file or directory The actual app is long gone, it was only the launch service that is generating error messages (for the last 5 years!) – Milliways Jan 22 '15 at 5:48
1

have you tried to locate & remove the obsolete Vodafone driver from the LaunchAgents, LaunchDaemons and/or StartupItems folders?

have a look in these locations:

  1. ~/Library/LaunchAgents
  2. /Library/LaunchAgents
  3. /Library/LaunchDaemons
  4. /System/Libary/LaunchAgents
  5. /System/Libary/LaunchDaemons

see HERE for more discussion

4
  • The question was NOT about how to disable the launch service, but filtering the log – Milliways Jan 24 '15 at 11:46
  • you said the that service was OBSOLETE and generating errors for the last 5 years. so instead of just filtering the log—masking the problem—you could fix the source of the error by getting rid of the obsolete service, which is what most of us would do. of course, that’s entirely up to you. sorry i was unable to help. i’ll know better the next time you pose a question. – user1082 Jan 24 '15 at 19:29
  • I appreciate your attempt to help, but you would be better to read the question, which was in the 1st line. FYI I was repairing an old Mac. As soon as I saw the log, I killed the offending services. All I wanted to do was read the log, for other reasons, without all the irrelevant detail. – Milliways Jan 24 '15 at 22:34
  • user1082. I feel for you. This is exactly the help this user needed. Get rid of those dead LaunchAgents. In my case, though, I have a program which I am still using. In my case your other answer to hide was what I needed. Thanks for both answers. The people we help alas are not always grateful. – Foliovision Aug 5 '16 at 6:10
0

I've successfully filtered log entries from /var/log/system.log by creating a new file in /etc/asl/custom.cleanup.conf with these entries -

# Ignore some noisy log entries.

? [CA= Message Google Chrome He] file /dev/null
? [CA= Message Google Chrome He] claim

? [CA= Message Time to encode state for window] file /dev/null
? [CA= Message Time to encode state for window] claim

You would adjust your filters to match the specific log entries you wish to exclude; the above filters match the log entries I wanted to get rid of (section below).

Once the config file is created (note you'll need to edit with root permissions in that directory), restart syslog with

sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist
sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist

These are the log entries I wanted to exclude.

Aug 20 10:38:54 strike iTerm2[11929]: Time to encode state for window <PseudoTerminal: 0x7ff611223344 tabs=2 window=<PTYWindow: 0x7ff611223344 frame=NSRect: {{-0, 6}, {1914, 1051}} title=1. sudo alpha=1.000000 isMain=1 isKey=1 isVisible=1 delegate=0x7ff611223344>>: 0.01158303022384644

Aug 20 10:38:56 strike kernel[0]: Google Chrome He[72873] triggered unnest of range 0x7fff11223344->0x7fff11223344 of DYLD shared region in VM map 0x84d623d211223344. While not abnormal for debuggers, this increases system memory footprint until the target exits.

syslog does then complain about not being able to write to /dev/null, but the filtered items will be excluded from /var/log/system.log which is your intended outcome!

Aug 20 11:36:31 strike syslogd[74699]: Disabling module custom.cleanup.conf writes to /dev/null following 6 failures (Operation Failed)

I'd love to hear of a cleaner way to configure this, especially if it doesn't require two lines per filter :)

5
  • I'm with you as for a desire for a "better" way of doing this. However, your method works splendidly to filter out a lot of log spam. – Michael Sep 26 '16 at 16:48
  • I used this successfully as ``` # ignore mDNSResponder reports about P2P packets from Spotify ? [CA= Message Unknown DNS packet type 6f74] ignore ? [CA= Message Unknown DNS packet type 6f74] claim ``` to filter out mDNSResponder complaints about Spotify P2P packets. Note the ignore instead of file /dev/null; the file must be a regular file or else the mentioned error will be logged. So "ignore" is the cleaner way ;) – RJVB Jun 26 '17 at 16:38
  • @Chris Burgess, is /etc/asl/custom.cleanup.conf documented somewhere? – 1.61803 Jun 27 '17 at 8:04
  • I can't find docs and don't have that machine handy; possibly I've included it from /etc/asl.conf or perhaps that directory is already loaded by the same? – Chris Burgess Jun 27 '17 at 20:35
  • @Chris Burgess, it seems modules are 10.9+, see my answer for details. – 1.61803 Jun 28 '17 at 12:06
0

The asl.conf man page states that it may contain query-action rules in the form

? query action …

and that query has the format

[operator key value]

Example

? [= Sender foobar] [<= Level error] notify com.apple.foobar
  op   key   value   op  key   value
  -----query 1----- -----query 2---- ---------action--------

From that same source (bold is mine)

ignore           Causes a matching message to be ignored in all **subsequent** matching rules.

Configurations that used to be in syslog.conf are now in asl.conf below the comment

# Flat file configurations formerly in syslog.conf

It is my understanding that, in order to ignore messages in both system.log and in Console.app, you should put rules to ignore messages before the comment above.

Example with modifier S, which ignores messages matching that substring from SIMBL Agent.

? [= Sender SIMBL Agent] [S= Message warning: failed to get scripting definition from] ignore
  op -key-- ---value---  mod --key-- --------------------value-----------------------
  --------query 1------- -----------------------query 2------------------------------- action

After adding a rule restart the daemon with sudo killall HUP syslogd.

Tested successfully in OS X 10.8.5.

UPDATE

Modules seem to have appeared on 10.9, see here.

If the /etc/asl directory exists, then syslogd and aslmanager will read each file it contains. These files must have the same format as asl.conf. Each file configures an independent module, identified by the file name. Modules may be enabled or disabled independently. Each module may specify its own set of rules for acting on received messages. See the ASL MODULES section for details.

Thus filters could be configured in a separate file. I haven't tested it though.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .