Is there any way of Filtering out messages from OS X system log?

Question

Is there any way of Filtering out messages from OS X system log?

I am looking through the log on an old MacBook running Lion.

This has an error message every 10 seconds from an obsolete service:

com.apple.launchd.peruser.503[154] (de.novamedia.VodafoneDeviceObserver[1386]): posix_spawn("/Library/Application Support/Vodafone/NML2NDeviceObserver.app/Contents/MacOS/NML2NDeviceObserver", ...): No such file or directory

The actual app is long gone, it was only the launch service that is generating error messages (for the last 5 years!)

Answer 1

if you just wish to hide the error messages that are cluttering up the console log, for easier readability, then this can easily be accomplished by selecting any one of the offending event messages, then click 'Ignore Sender' on the Console toolbar; those messages will then be hidden from view. the event messages are still generated, until you fix the obsolete driver issue, but you won't see them in the Console. see more info HERE and HERE.

Answer 2

have you tried to locate & remove the obsolete Vodafone driver from the LaunchAgents, LaunchDaemons and/or StartupItems folders?

have a look in these locations:

1. ~/Library/LaunchAgents
2. /Library/LaunchAgents
3. /Library/LaunchDaemons
4. /System/Libary/LaunchAgents
5. /System/Libary/LaunchDaemons

see HERE for more discussion

Answer 3

I've successfully filtered log entries from /var/log/system.log by creating a new file in /etc/asl/custom.cleanup.conf with these entries -

# Ignore some noisy log entries.

? [CA= Message Google Chrome He] file /dev/null
? [CA= Message Google Chrome He] claim

? [CA= Message Time to encode state for window] file /dev/null
? [CA= Message Time to encode state for window] claim

You would adjust your filters to match the specific log entries you wish to exclude; the above filters match the log entries I wanted to get rid of (section below).

Once the config file is created (note you'll need to edit with root permissions in that directory), restart syslog with

sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist
sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist

---

These are the log entries I wanted to exclude.

Aug 20 10:38:54 strike iTerm2[11929]: Time to encode state for window <PseudoTerminal: 0x7ff611223344 tabs=2 window=<PTYWindow: 0x7ff611223344 frame=NSRect: {{-0, 6}, {1914, 1051}} title=1. sudo alpha=1.000000 isMain=1 isKey=1 isVisible=1 delegate=0x7ff611223344>>: 0.01158303022384644

Aug 20 10:38:56 strike kernel[0]: Google Chrome He[72873] triggered unnest of range 0x7fff11223344->0x7fff11223344 of DYLD shared region in VM map 0x84d623d211223344. While not abnormal for debuggers, this increases system memory footprint until the target exits.

syslog does then complain about not being able to write to /dev/null, but the filtered items will be excluded from /var/log/system.log which is your intended outcome!

Aug 20 11:36:31 strike syslogd[74699]: Disabling module custom.cleanup.conf writes to /dev/null following 6 failures (Operation Failed)

I'd love to hear of a cleaner way to configure this, especially if it doesn't require two lines per filter :)

Answer 4

The asl.conf man page states that it may contain query-action rules in the form

? query action …

and that query has the format

[operator key value]

Example

? [= Sender foobar] [<= Level error] notify com.apple.foobar
  op   key   value   op  key   value
  -----query 1----- -----query 2---- ---------action--------

From that same source (bold is mine)

ignore           Causes a matching message to be ignored in all **subsequent** matching rules.

Configurations that used to be in syslog.conf are now in asl.conf below the comment

# Flat file configurations formerly in syslog.conf

It is my understanding that, in order to ignore messages in both system.log and in Console.app, you should put rules to ignore messages before the comment above.

Example with modifier S, which ignores messages matching that substring from SIMBL Agent.

? [= Sender SIMBL Agent] [S= Message warning: failed to get scripting definition from] ignore
  op -key-- ---value---  mod --key-- --------------------value-----------------------
  --------query 1------- -----------------------query 2------------------------------- action

After adding a rule restart the daemon with sudo killall HUP syslogd.

Tested successfully in OS X 10.8.5.

UPDATE

Modules seem to have appeared on 10.9, see here.

If the /etc/asl directory exists, then syslogd and aslmanager will read each file it contains. These files must have the same format as asl.conf. Each file configures an independent module, identified by the file name. Modules may be enabled or disabled independently. Each module may specify its own set of rules for acting on received messages. See the ASL MODULES section for details.

Thus filters could be configured in a separate file. I haven't tested it though.