Bug: syslog daemon changes break its usage on macOS 10.13 and above #136

Closed
opened 2026-01-19 18:29:21 +00:00 by michael · 1 comment
Owner

Originally created by @sambacha on GitHub.

Summary

On macOS 12.x (Monterey), Apple has changed the behavior of their syslog daemon - it no longer listens on a domain socket. Therefore, you cannot reliably expect this to work on macOS 10.13 and above.

Suggestions for using syslog should be adjusted accordingly, depending on the version of macOS.

Possible fixes

Apple has unified the system logging and syslog no longer contains the entries we would need, even if it did work as expected. Checkout this tool https://eclecticlight.co/consolation-t2m2-and-log-utilities/ and this blog post https://eclecticlight.co/2020/02/07/how-long-does-your-mac-keep-its-log-for/ for more information.

Originally created by @sambacha on GitHub. <!--- Please read this! Before opening a new issue, make sure to search for keywords in the issues filtered by the "regression" or "bug" label and verify the issue you're about to submit isn't a duplicate. ---> ### Summary On macOS 12.x (Monterey), Apple has changed the behavior of their syslog daemon - it no longer listens on a domain socket. Therefore, you cannot reliably expect this to work on macOS 10.13 and above. Suggestions for using syslog should be adjusted accordingly, depending on the version of macOS. ### Possible fixes Apple has unified the system logging and syslog no longer contains the entries we would need, even if it did work as expected. Checkout this tool https://eclecticlight.co/consolation-t2m2-and-log-utilities/ and this blog post https://eclecticlight.co/2020/02/07/how-long-does-your-mac-keep-its-log-for/ for more information.
Author
Owner

@golbiga commented on GitHub:

This does not appear to be an issue with the project, moving to discussions.

@golbiga commented on GitHub: This does not appear to be an issue with the project, moving to discussions.
Sign in to join this conversation.
No Label
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#136