1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
|
#############################################################################
# Copyright (c) 2023 Hofi <hofione@gmail.com>
#
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License version 2 as published
# by the Free Software Foundation, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
#
# As an additional exemption you are allowed to compile & link against the
# OpenSSL libraries as published by the OpenSSL project. See the file
# COPYING for details.
#
#############################################################################
# NOTE: For predicate hints see:
# log help predicates
@define def-osl-predicate " (eventType == 'logEvent' || eventType == 'lossEvent' || eventType == 'stateEvent' || eventType == 'userActionEvent')
&& (logType != 'debug')
"
@define def-osl-stream-params "--type log --type trace --level info --level debug"
block source darwin-oslog(...) {
@requires darwinosl "The darwinosl() source driver depends on the darwinosl module"
darwinosl(
filter-predicate("`def-osl-predicate`")
`__VARARGS__`
flags(syslog-protocol dont-store-legacy-msghdr assume-utf8)
);
};
# NOTE: There is no public API call to query the live log stream, so we are just capturing output of /usr/bin/log
block source darwin-oslog-stream(params("`def-osl-stream-params`")) {
channel {
source {
program(
"/usr/bin/log stream `params` --style ndjson"
flags(
no-parse
no-multi-line
dont-store-legacy-msghdr
assume-utf8
)
);
};
parser {
json-parser(
prefix(".darwinoslog.")
);
date-parser(
format("%Y-%m-%d %T.%f%z")
template("${.darwinoslog.timestamp}")
);
add-contextual-data(
selector("${.darwinoslog.messageType}"),
database("`scl-root`/darwinosl/darwinosl-metadata-db.csv"),
default-selector("unknown"),
prefix(".darwinoslog.")
);
};
rewrite {
set("$(if ('$(strip ${.darwinoslog.processImagePath})' != '') '$(basename ${.darwinoslog.processImagePath})' '')", value("PROGRAM"));
subst(
" ",
"\\0x20",
value("PROGRAM"),
flags("global")
);
set-pri("${.darwinoslog.unixpri}");
set("${.darwinoslog.processID}", value("PID"));
set("${.darwinoslog.activityIdentifier}$(if ('${.darwinoslog.subsystem}' != '') ' (${.darwinoslog.subsystem})' '')$(if ('${.darwinoslog.category}' != '') ' [${.darwinoslog.category}]' '') ${.darwinoslog.eventMessage}", value("MSG"));
set("local+darwinoslog_stream" value("TRANSPORT"));
};
};
};
|
