Skip to content

Instantly share code, notes, and snippets.

@dbrinegar
Last active August 8, 2017 06:48
Show Gist options
  • Save dbrinegar/6095828 to your computer and use it in GitHub Desktop.
Save dbrinegar/6095828 to your computer and use it in GitHub Desktop.
mac system.log spam control
Noticed /var/log/system.log is a huge file that hasn't rotated for months, and tailing is spammy:
Jul 27 11:17:55 MacMini-2012.local Google Chrome Helper EH[62270]: CFPropertyListCreateFromXMLData(): Old-style plist parser: missing semicolon in dictionary on line 3. Parsing will be abandoned. Break on _CFPropertyListMissingSemicolon to debug.
and
Jul 27 11:18:16 MacMini-2012.local coreaudiod[136]: Disabled automatic stack shots because audio IO is active
I want to tell the system that I permanently don't care about these messages, so let's add
ignore lines at the top of asl.conf. This is a first-rule type configuration file, so if
we want to not log these anyway the ignore command should be in front. Signal syslogd when
done so it picks up the change. You should see those messages go away immediately. I use
the [S= substring match so I don't have to type the whole sender or message exactly, so
think about precision of your ignore filter here.
$ sudo vim /etc/asl.conf
# S= means substring match
? [S= Sender Google Chrome] [S= Message CFPropertyListCreateFromXMLData] ignore
? [S= Sender coreaudiod] [S= Message automatic stack shots] ignore
$ sudo killall -HUP syslogd
Now let's deal with the other issue, which is that system.log isn't rolling over. It turns
out that the default is to roll over system.log every midnight. Of course, most Macs are
asleep at midnight so this seems like a bug. Let's fix it so that system.log is rolled over
just like the other logs here, when it gets to 1 Meg in size. No need to run newsyslog or
signal for a config change, it'll pick it up next run.
$ sudo vim /etc/newsyslog.conf
#/var/log/system.log 640 7 * @T00 J
# dab changed to work on a system that sleeps
/var/log/system.log 640 7 1000 * J
Much better!
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment