2

This is my first time to using a Mac, some macOS settings need to edit due to Security Audit.

We are using macOS 10.9 to 10.12 version in 10 of iMac, we’ve had an problem is how to keep long time record for “system.log”?

Mar 13 09:18:44 BSHK001110.local authorizationhost[8125]: Failed to authenticate user <admin> (error: 9).
Mar 13 09:18:45 BSHK001110.local authorizationhost[8125]: Failed to authenticate user <admin> (error: 9).
Mar 13 09:18:45 BSHK001110.local authorizationhost[8125]: Failed to authenticate user <admin> (error: 9).

In my observation, system.log will rebuild by script if the Macs don't shutdown at night and log file only keep around one day data.

Is there any chance to change specific date (one month) to rebuild system.log file and keep one month data?

Remarks: I have upgraded macOS 10.13.3 and found that there is no record about "Failed to authenticate". Is there any problem in macOS 10.13?

Improve this question
2
  • Shouldn't you just copy these off the Mac systematically and store them? Also - you may need to query the log filesystem to get things on High Sierra as less and less goes to files and instead gets logged to the central logging database.
    – bmike ♦
    Commented Mar 13, 2018 at 2:12
  • Yes, if you need to keep logs, you should copy them. And the ones you failed to copy are still in your backups.
    – WGroleau
    Commented Mar 13, 2018 at 2:18

2 Answers 2

Reset to default
4

Your settings for for the syslog are found in /etc/asl.conf.

There's a section that governs how the system log operates.

# Rules for /var/log/system.log
> system.log mode=0640 format=bsd rotate=seq compress file_max=5M all_max=50M
? [= Sender kernel] file system.log
? [<= Level notice] file system.log
? [= Facility auth] [<= Level info] file system.log
? [= Facility authpriv] [<= Level info] file system.log

Specifically, the log will rotate (by default) when it hits 5M in size, not overnight and the whole set of log files will rotate when it hits 50M cumulatively (10 files in total). If you wan to increase the size, just edit the line as you see fit.

> system.log mode=0640 format=bsd rotate=seq compress file_max=5M all_max=50M

I wouldn't increase the size of the individual files themselves, but rather the collective total.

That said, if you are collecting logs for a number of machines, you should be using a syslog server.

Improve this answer
2
  • Thank you for your help! This is a good experience for me to learning Apple product. So, syslog server / copy files will be my next action.
    – Hayes Chann
    Commented Mar 13, 2018 at 2:28
  • In the security field you absolutely need a syslog server. This server should be highly protected because it will be the safe deposit of all kind of attack tracks and sometimes of password in clear.
    – athena
    Commented Nov 27 at 16:19
0

To keep /var/log/system.log for one month, you need to edit /etc/asl.conf more precisely the lines:

# Rules for /var/log/system.log
> system.log mode=0640 format=bsd rotate=seq compress file_max=5M all_max=50M

to explicitely ask for a conservation for 30 days with the ttl parameter, and slightly increase the all_max if you want to deal with DDOS attacks:

# Rules for /var/log/system.log
> system.log mode=0640 format=bsd rotate=seq compress ttl=30 file_max=5M all_max=150M

the default value of ttl is 7, which is rather too short to analyze a real security problem which started many days ago.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .