2

I'm using this application (Solar.app) from Logitech to monitor the solar cells and batteries from their own solar keyboard (K750)

One process is much too verbose and logs approx. 400 bytes in /var/log/system.log at each keystroke.

I'm looking for various solutions to prevent the process from flooding system.log.

Jan  5 17:32:11 pc96 Solar Service[702]: Input data callback for device 0x6047d0
Jan  5 17:32:11 pc96 Solar Service[702]: End of data
Jan  5 17:32:11 pc96 Solar Service[702]: Event = 1 device index = 1
Jan  5 17:32:11 pc96 Solar Service[702]: Input data callback for device 0x6047d0
Jan  5 17:32:11 pc96 Solar Service[702]: End of data
Jan  5 17:32:11 pc96 Solar Service[702]: Event = 1 device index = 1

I have been able to find a rule to match those messages, but:

1/

# ? [= Facility com.Logitech.Solar-Service] file solar-Service.log format=raw

This rule (when used alone) actually logs the messages to a different file, in addition to system.log. Here is solar-Service.log:

[Level 4] [Time 1452071909] [TimeNanoSec 309468000] [PID 702] [Sender Solar Service] [Facility com.Logitech.Solar-Service] [CFLog Local Time 2016-01-06 10:18:29.309] [CFLog Thread 160b] [ReadUID 501] [Message Event = 1 device index = 1] [UID 501] [GID 20] [SenderMachUUID C4A60E0E-5968-829C-BC55-931BBEB0A7F7] [Host pc96]
[Level 4] [Time 1452071909] [TimeNanoSec 951289000] [PID 702] [Sender Solar Service] [Facility com.Logitech.Solar-Service] [CFLog Local Time 2016-01-06 10:18:29.951] [CFLog Thread 160b] [ReadUID 501] [Message Input data callback for device 0x6047d0] [UID 501] [GID 20] [Host pc96] [SenderMachUUID C4A60E0E-5968-829C-BC55-931BBEB0A7F7]

2/

? [= Facility com.Logitech.Solar-Service] ignore

.. but this rule (when used alone), does not ignore the messages.

and I don't understand why it is so.

  • Possible duplicate of How to disable logging to system.log in OS X? – klanomath Jan 5 '16 at 17:17
  • @klanomath That filters on error level and won't work for filtering one sender or one facility. Let's leave them linked for now and both open for answers. Now if you wanted to explain how to decipher the log level of this app's messages and then link to the other filtering change, that might be cool. – bmike Jan 5 '16 at 17:58
  • @bmike There is another q&a which fits better (as duplicate) but I can't find it. – klanomath Jan 5 '16 at 18:02
  • If all else fails, try setting the file name for the log file to /dev/null. – nohillside Jan 6 '16 at 9:42
1

To follow up on bmike's answer, the app identifier is com.logitech.Solar-App. So the code you want to put in your asl.conf is

? [= Facility com.logitech.Solar-App] ignore

If you want to confirm that I'm right about your app identifier, try:

/usr/libexec/PlistBuddy -c 'Print CFBundleIdentifier' /Applications/Solar\ App.app/Contents/Info.plist 

And if you want this to go into effect right away, you can restart syslogd with something like this:

sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist 
sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist
0

Yes - there is a way to ignore messages from a specific sender / application instead of filtering based on severity of all messages. You will need to be minimally comfortable with the terminal or have a backup and be willing to erase your Mac and restore from the backup should you make syntax errors or cause issues in terminal.

The overview is:

  • back up the system and make a backup copy of the system log configuration file
  • edit the configuration file (use nano instead of vi if you aren't used to using vi)
  • restart the logging process
  • test

You need an admin user to proceed:

sudo cp -p /etc/asl.conf /etc/asl.bak
sudo vi /etc/asl.conf
sudo killall HUP syslog

Here are the three lines (well one blank line doesn't render here and the first line is a comment so the only line that's needed is the one with Facility in it) I added to ignore the App Store messages from my system's /var/log/system.log file:

# ignore "App Store" messages
? [= Facility com.apple.appstore] ignore

You should replace the com.apple.appstore with the results of your application.

mdls -name kMDItemCFBundleIdentifier /Applications/Solar\ Service.app/

I tried matching the application name with [= Sender "App Store"] ignore but the spaces in the application name didn't seem to be respected or maybe that's just not how the log system works. The Facility seems to match to kMDItemCFBundleIdentifier in my testing.

Now, the bad news. The logging system is capable of logging thousands of messages a second so ignoring the messages isn't going to do much but make that one file easier to look at. You might need to contact the vendor to get the application changed, but hopefully hiding the messages works for your needs since that's something you should be able to do easily.

  • I'm working on it but I'm still not able to stop it from logging to system.log. Is there a way to make the logs actually more verbose to help me catch my error if any ? I'm sometimes tail -f' ing that file.. that's why I'm interested in this – alecail Jan 5 '16 at 18:14
  • See my edit.. maybe you know the answer ? – alecail Jan 6 '16 at 9:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .