I guess this keeps naive asl(3) users from shooting themselves in the foot, flooding the system log with all kinds of fluff and such.

If you want your app to have searchable entries in ASL, it seems that you have to edit /etc/asl.conf setting up a rule to create an individual store for your app.

Using the code below, I couldn\’t get any ASL-generated log messages to appear in the console log as viewed via Console.app. Didn\’t matter what severity level I chose.

#include
#import

int main (int argc, const char * argv[])
{
aslclient asl = asl_open(NULL, \”com.apple.console\”, ASL_OPT_STDERR | ASL_OPT_NO_REMOTE | ASL_OPT_NO_DELAY);
if (asl == NULL)
{
fprintf(stderr, \”%s\”, \”Can\’t open a connection to ASL\”);
return -1;
}

asl_log(asl, NULL, ASL_LEVEL_WARNING, \”Supercalifragilisticexpialidocious\”);
asl_log(asl, NULL, ASL_LEVEL_NOTICE, \”Supercalifragilisticexpialidocious\”);
asl_log(asl, NULL, ASL_LEVEL_ALERT, \”Supercalifragilisticexpialidocious\”);
asl_log(asl, NULL, ASL_LEVEL_ERR, \”Supercalifragilisticexpialidocious\”);

asl_close(asl);
}

Previously, writing to /dev/console (or, in an Aqua app, stdout or stderr) would also make messages appear in the appropriate place, but this doesn’t seem to work under Leopard. I should report that as a bug.

I don’t know anything about things that other UNIX operating systems call a “console”, so I can’t speak of any similarities that Apple’s Console app, Console Messages query, or console device may have to it.

The default filter will retain messages in the range 0 (Emergency) to 5 (Notice) inclusive.

Info is the second-lowest level—number 6. (Debug is the lowest, at 7.)

I mentioned this in “Client connections”:

The default filter mask of every connection, according to asl.h, is ASL_FILTER_MASK_UPTO(ASL_LEVEL_NOTICE); i.e., everything but ASL_LEVEL_INFO and ASL_LEVEL_DEBUG.

What does come out in All Messages are calls to NSLog apparently.

Those are also under Console Messages, as NSLog uses the Console facility. (Again, see “Client connections”.)

I wonder why I have log files from dozens of apps in ~/Library/Logs if this database thingy works and is a good idea.

Several reasons:

1. Not everyone knows about ASL. Apple hasn’t made a very big deal about its existence; indeed, this series of posts is the most anyone’s written about it, including Apple.
2. Even those who know about it may not have tried to actually use it directly, since NSLog works just fine. We Cocoa programmers are lazy. ☺
3. ASL didn’t always exist. Old code uses log files because the alternative was syslog, which did the same thing—except that syslog used one log file for all processes. At least with your own log file, you didn’t have to go sifting through that one common log file to find your application’s messages. (Not a problem anymore: If you use ASL, syslog, or NSLog, you can save a database query in the Console’s sidebar to easily obtain your app’s messages.)
4. Cross-platform programmers may not want to write code that depends on an API that only exists on one platform. For these programmers, extra functionality on one platform is a burden because that functionality, by definition of the word extra, doesn’t exist on other platforms.

#import <asl.h>
int main(int argc, char const *argv[]) {
    asl_log(NULL, NULL, ASL_LEVEL_INFO, "Supercalifragilisticexpialidocious");
}

run it, then I open Console.app, click on All Messages, and it isn’t there. If I search on Supercalifragilisticexpialidocious, it isn’t there.

I wrote some Cocoa classes that open a file in ~/Library/Logs and connect that to the asl_log, and those come out in the file, but not in the All Messages of Console. What does come out in All Messages are calls to NSLog apparently.

I wonder why I have log files from dozens of apps in ~/Library/Logs if this database thingy works and is a good idea. I can’t see much from other apps turning up in All Messages.

… are these log messages visible outside of you writing your own code to search them?

They’re only accessible through the ASL API, which Console (in Leopard) is a GUI on top of.

I was expecting them to turn up somewhere in Console.app since that seems to show logs from all manner of applications, …

They should.

… but nothing appeared until I opened my own file in ~/Library/Logs and logged to that.

You probably searched incorrectly. If you logged it with a facility other than com.apple.console, it won’t show under “Console Messages”; you’ll need to switch to “All Messages”, or a custom query tailored to find your messages. If you did use a custom query, either you constructed it incorrectly or you’ve found a bug in ASL.

It seems rather odd to me that there is a standard logging library that squirrels it away in an unknown place with no standard application that can access them.

Console is that standard application.

And what of log cycling? Am I supposed to take some action to stop logs growing forever?

No; by default, syslogd will automatically delete messages older than 24 hours. See undocumented keys.

Implementation detail or not, I’m curious where they end up on Leopard.

As of 10.5.6, /var/log/asl.db. But don’t ever rely on that in shipping code.

And what of log cycling? Am I supposed to take some action to stop logs growing forever?

Implementation detail or not, I’m curious where they end up on Leopard.

You can search the log more easily, now that messages are no longer just text. (This was improved in Leopard, which uses a real database for the log storage; Tiger used a text-based log file.)

Before you ask where that database is: It’s an implementation detail, as I wrote in “Searching”:

[The database] file is not guaranteed to always be in the same place, and it didn’t even exist in Tiger (it was a plain-text log file instead).