1.\"Copyright (c) 2004-2012 Apple Inc. All rights reserved. 2.\" 3.\"@APPLE_LICENSE_HEADER_START@ 4.\" 5.\"This file contains Original Code and/or Modifications of Original Code 6.\"as defined in and that are subject to the Apple Public Source License 7.\"Version 2.0 (the 'License'). You may not use this file except in 8.\"compliance with the License. Please obtain a copy of the License at 9.\"http://www.opensource.apple.com/apsl/ and read it before using this 10.\"file. 11.\" 12.\"The Original Code and all software distributed under the License are 13.\"distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 14.\"EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 15.\"INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 16.\"FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 17.\"Please see the License for the specific language governing rights and 18.\"limitations under the License. 19.\" 20.\"@APPLE_LICENSE_HEADER_END@ 21.\" 22.Dd October 18, 2004 23.Dt ASLUTIL 1 24.Os 25.Sh NAME 26.Nm aslutil 27.Nd Apple System Log utility 28.Sh SYNOPSIS 29.Nm 30.Fl help 31.D1 "" 32.Nm 33.Fl s 34.Op Fl r Ar host 35.Op Fl l Ar level 36message... 37.D1 "" 38.Nm 39.Fl s 40.Op Fl r Ar host 41.Fl k 42key val 43.Op key val 44.Li ... 45.D1 "" 46.Nm 47.Fl C 48.D1 "" 49.Nm 50.Op Fl f Ar file ... 51.Op Fl d Ar dir ... 52.Op Fl B 53.Op Fl w Op Ar n 54.Op Fl F Ar format 55.Op Fl T Ar format 56.Op Fl E Ar format 57.Ar expression 58.D1 "" 59.Nm 60.Op Fl f Ar file ... 61.Op Fl d Ar dir ... 62.Fl x Ar file Ar expression 63.D1 "" 64.Nm 65.Fl c Ar process Op filter 66.D1 "" 67.Nm 68.Fl config Op options 69.D1 "" 70.Nm 71.Fl module 72.Op name Op action 73.Sh DESCRIPTION 74.Nm 75is a command-line utility for a variety of tasks relating to the Apple System Log (ASL) facility. 76It provides mechanisms for sending and viewing log messages, 77copying log messages to ASL format data store files, 78and for controlling the flow of log messages from client processes. 79.Pp 80When invoked with the 81.Fl help 82option, 83.Nm 84prints a usage message. 85.Ss SENDING MESSAGES 86The 87.Fl s 88option is used send log messages to the 89.Xr asld 8 90log message daemon, 91either locally or to a remote server if the 92.Fl r Ar host 93option in used. 94.Pp 95There are two main forms of the command. 96If the 97.Fl k 98option is used, then it must be followed by a list of keys and values. 99A structured message will be sent to the server with the keys and values given as arguments. 100If a key or a value has embedded white space, it must be enclosed in quotes. 101.Pp 102Note that the text of the log message should be supplied as a value following the 103.Dq Message 104key. 105.Pp 106If the 107.Fl k 108option is not specified, then the rest of the command line is treated as the message text. 109The text may be preceded by 110.Fl l Ar level 111to set the log level (priority) of the message. 112Levels may be an integer value corresponding the the log levels specified in 113.Xr syslog 3 114or 115.Xr asl 3 , 116or they may be a string. 117String values are case insensitive, and should be one of: 118.Pp 119.Bl -tag -compact 120.It Emergency 121(level 0) 122.It Alert 123(level 1) 124.It Critical 125(level 2) 126.It Error 127(level 3) 128.It Warning 129(level 4) 130.It Notice 131(level 5) 132.It Info 133(level 6) 134.It Debug 135(level 7) 136.El 137.Pp 138The string 139.Dq Panic 140is an alias for 141.Dq Emergency . 142.Pp 143If the 144.Fl l 145option is omitted, the log level defaults to 7 (Debug). 146.Pp 147.Nm 148only requires one or two leading characters for a level specification. 149A single character suffices in most cases. 150Use 151.Dq P 152or 153.Dq \&Em 154for Panic / Emergency, and 155.Dq \&Er 156or 157.Dq X 158for Error). 159.Ss READING MESSAGES 160The 161.Nm asld 162daemon filters and saves log messages to different output streams. 163One module saves messages to files specified in the 164.Xr syslog.conf 5 165file. 166Those log files may be examined with any file printing or editing utility, 167e.g. 168.Pp 169.Dl cat /var/log/system.log 170.Pp 171Another module saves messages in a data store (/var/log/asl). 172.Pp 173If invoked with no arguments, 174.Nm 175fetches all messages from the active data store. 176Messages are then printed to standard output, 177subject to formatting options and character encoding as described below. 178Some log messages are read-access controlled, 179so only messages that are readable by the user running 180.Nm 181will be fetched and printed. 182.Pp 183If invoked with the 184.Fl C 185option, 186.Nm 187fetches and prints console messages. 188The 189.Fl C 190option is actually an alias for the expression: 191.Pp 192.Dl -k Facility com.apple.console 193.Pp 194See the EXPRESSIONS section below for more details. 195.Pp 196Individual ASL data store files may be read by providing one or more file names as arguments to the 197.Fl f 198option. 199This may be useful when searching archived files, files on alternate disk volumes, 200or files created as export files with the 201.Fl x 202option. 203.Pp 204The 205.Fl d 206option may be followed by a list of directory paths. 207.Nm 208will read or search all ASL data store files in those directories. 209Any files that are not readable will be skipped. 210Specifying 211.Fl d 212with the name 213.Dq archive 214will open all readable files in the default ASL archive directory /var/log/asl.archive. 215Specifying 216.Fl d 217with the name 218.Dq store 219will open all readable files in the ASL store directory /var/log/asl. 220.Pp 221Legacy ASL database files that were written by 222.Nm asld 223on Mac OS X 10.5 (Leopard) may also be read using the 224.Fl f 225option. 226However only one such legacy database may be read or searched at a time. 227Note that a legacy database may be read and copied into a new ASL data store format file using a combination of 228.Fl f 229and 230.Fl x 231options. 232.Pp 233The 234.Fl B 235option causes 236.Nm 237to start processing messages beginning at the time of the last system startup. 238If used in conjunction with 239.Fl w , 240all messages since the last system startup are displayed, or matched against an expression, before 241.Nm 242waits for new messages. 243.Pp 244The 245.Fl w 246option causes 247.Nm 248to wait for new messages. 249By default, 250.Nm 251prints the last 10 messages, 252then waits for new messages to be added to the data store. 253A number following the 254.Fl w 255option specifies the number of messages to print and overrides the default value of 10. 256For example: 257.Pp 258.Dl aslutil -w 20 259.Pp 260Use the value 261.Dq all 262to view all messages in the data store before watching for new messages. 263The value 264.Dq boot 265will display messages since the last system startup before watching for new messages. 266Specifying 267.Dq -w boot 268is equivalent to using 269.Fl w 270and 271.Fl B 272together. 273.Pp 274Using 275.Nm 276with the 277.Fl w 278option is similar to watching a log file using, e.g. 279.Pp 280.Dl tail -f /var/log/system.log 281.Pp 282The 283.Fl w 284option can only be used when reading the system's ASL data store or when reading a single data store file, 285and when printing messages to standard output. 286.Pp 287If the 288.Fl x Ar file 289option is specified, messages are copied to the named file rather than being printed. 290The file will be created if it does not exist. 291.Pp 292When called without the 293.Fl x 294option, messages are printed to standard output. 295Messages are printed in a format similar to that used in the system.log file, 296except that the message priority level is printed between angle-brackets. 297.Pp 298The output format may by changed by specifying the 299.Fl F Ar format 300option. 301Non-printable and control characters are encoded by default. 302Text encoding may be controlled using the 303.Fl E 304option (see below). 305The value of 306.Ar format 307may be one of the following: 308.Pp 309.Bl -tag -width "xxxx" 310.It bsd 311Format used by the 312.Nm syslogd 313daemon for system log files, e.g. /var/log/system.log. 314.It std 315Standard (default) format. 316Similar to 317.Dq bsd , 318but includes the message priority level. 319.It raw 320Prints the complete message structure. 321Each key/value pair is enclosed in square brackets. 322Embedded closing brackets and white space are escaped. 323Time stamps are printed as seconds since the epoch by default, but may also be 324printed in local time or UTC if the 325.Fl T 326option is specified (see below). 327.It xml 328The list of messages is printed as an XML property list. 329Each message is represented as a dictionary in a array. 330Dictionary keys represent message keys. 331Dictionary values are strings. 332.El 333.Pp 334Each of the format styles above may optionally be followed by a dot character and an integer value, for example: 335.Pp 336.Dl aslutil -F std.4 337.Pp 338This causes sub-second time values to be printed. 339In the example above, 4 decimal digits would be printed. 340The sub-second time values come from the value of the TimeNanoSec key in the ASL message. 341If the TimeNanoSec key is missing, a value of zero is used. 342.Pp 343The value of the 344.Ar format 345argument may also be a custom print format string. 346A custom format should in most cases be enclosed in single quotes to prevent the shell from substituting 347special characters and breaking at white space. 348.Pp 349Custom format strings may include variables of the form 350.Dq $Name , 351.Dq $(Name) , 352or 353.Dq $((Name)(format)) . 354which will be expanded to the value associated with the named key. 355For example, the command: 356.Pp 357.Dl aslutil -F '$Time $Host $(Sender)[$(PID)] <$((Level)(str))>: $Message' 358.Pp 359produces output similar to the 360.Dq std 361format. 362The simple 363.Dq $Name 364form is sufficient in most cases. 365However, the second form: 366.Dq $(Name) 367must be used if the name is not delimited by white space. 368The third form allows different formats of the value to be printed. 369For example, a message priority level may appear as an integer value (e.g. 370.Dq 3 ) 371or as a string (``Error''). 372The following print formats are known. 373.Pp 374.Bl -tag -width "$((Time)([+|-]HH[:MM]))" 375.It $((Level)(str)) 376Formats a Level value as a string, for example 377.Dq Error , 378.Dq Alert , 379.Dq Warning , 380and so on. 381Note that $(Level) or $Level formats the value as an integer 0 through 7. 382.It $((Time)(sec)) 383Formats a Time value as the number of seconds since the Epoch. 384.It $((Time)(raw)) 385Alias for $((Time)(sec)). 386.It $((Time)(local)) 387Formats a Time value as a string of the form 388.Dq "Mmm dd hh:mm:ss" , 389where Mmm is the abbreviation for the month, dd is the date (1 - 31) and hh:mm:ss is the time. 390The local timezone is used. 391.It $((Time)(lcl)) 392Alias for $((Time)(local)). 393.It $((Time)(utc)) 394Formats a Time value as a string of the form 395.Dq "yyyy-mm-dd hh:mm:ssZ" , 396using Coordinated Universal Time, or the 397.Dq Zulu 398time zone. 399.It $((Time)(zulu)) 400Alias for $((Time)(utc)). 401.It $((Time)(X)) 402Where X may be any letter in the range A - Z or a - z. 403Formats the Time using the format 404.Dq "yyyy-mm-dd hh:mm:ssX" , 405using the specified nautical timezone. 406Z is the same as UTC/Zulu time. Timezones A - M (except J) decrease by one hour to the east of the 407Zulu time zone. 408Timezones N - Y increase by one hour to the west of Z. 409M and Y have the same clock time, but differ by one day. 410J is used to indicate the local timezone. 411When printing using $((Time)(J)), the output format is 412.Dq "yyyy-mm-dd hh:mm:ss" , 413without a trailing timezone letter. 414.It $((Time)(JZ)) 415Specifies the local timezone. 416The timezone offset from UTC follows the date and time. 417The time is formatted as 418.Dq "yyyy-mm-dd hh:mm:ss[+|-]HH[:MM]" . 419Minutes in the timezone offset are only printed if they are non-zero. 420.It $((Time)(ISO8601)) 421Specifies the local timezone and ISO 8601 extended format. 422The timezone offset from UTC follows the date and time. 423The time is formatted as 424.Dq "yyyy-mm-ddThh:mm:ss[+|-]HH[:MM]" . 425Minutes in the timezone offset are only printed if they are non-zero. 426Note that this differs from 427.Dq JZ 428format only in that a 429.Dq T 430character separates the date and time. 431.It $((Time)(ISO8601B)) 432Specifies the local timezone and ISO 8601 basic format, in the form: 433.Dq "yyyymmddThhmmss[+|-]HH[:MM]" . 434.It $((Time)(ISO8601Z)) 435Specifies UTC/Zulu time and ISO 8601 extended format, in the form: 436.Dq "yyyy-mm-ddThh:mm:ssZ" . 437.It $((Time)(ISO8601BZ)) 438Specifies UTC/Zulu time and ISO 8601 basic format, in the form: 439.Dq "yyyymmddThhmmssZ" . 440.It $((Time)([+|-]HH[:MM])) 441Specifies an offset (+ or -) of the indicated number of hours (HH) and optionally minutes (MM) to UTC. 442The value is formatted as a string of the form 443.Dq "yyyy-mm-dd hh:mm:ss[+|-]HH[:MM]" . 444Minutes in the timezone offset are only printed if they are non-zero. 445.El 446.Pp 447Each of the print formats listed above for Time values may optionally be followed by a dot character and an integer value. 448In that case, sub-second time values will be printed. 449For example, the following line prints messages with a UTC time format, and includes 6 digits of sub-second time: 450.Pp 451.Dl aslutil -F '$((Time)(utc.6)) $Host $(Sender)[$(PID)] <$((Level)(str))>: $Message 452.Pp 453If a custom format is not being used to specify the format for Time values, then Time values 454are generally converted to local time, except when the 455.Fl F Ar raw 456option is used, in which case times are printed as the number of seconds since the epoch. 457The 458.Fl T Ar format 459option may be used to control the format used for timestamps. 460The value of 461.Ar format 462may be one of the following: 463.Pp 464.Bl -tag -width "local or lcl" 465.It sec or raw 466Times are printed as the number of seconds since the epoch. 467.It local or lcl 468Times are converted to the local time zone, and printed with the format 469.Dl mmm dd hh:mm:ss 470where mmm is the month name abbreviated as three characters. 471.It utc or zulu 472Times are converted to UTC, and printed with the format 473.Dl yyyy-mm-dd hh:mm:ssZ 474.It A-Z 475Times are converted to the indicated nautical time zone, 476printed in the same format as UTC. 477.Dq J 478is interpreted as the local timezone and printed in the same format, 479but without a trailing timezone letter. 480.It JZ 481is interpreted as the local timezone and printed with the format 482.Dl yyyy-mm-dd hh:mm:ss[+|-]HH[:MM] . 483The trailing 484.Dq [+|-]HH[:MM] 485string represents the local timezone offset from UTC in hours, 486or in hours and minutes if minutes are non-zero. 487.It ISO8601 488Times are printed with the format specified by ISO 8601: 489.Dl yyyy-mm-ddThh:mm:ss[+|-]HH[:MM] . 490This is the same as the 491.Dq JZ 492format, except a 493.Dq T character separates the date and time components. 494.It [+|-]hh[:mm] 495The specified offset is used to adjust time. 496.El 497.Pp 498Each of the time formats above may optionally be followed by a dot character and an integer value. 499In that case, sub-second time values will be printed. 500For example: 501.Pp 502.Dl aslutil -T bsd.3 503.Pp 504The 505.Fl u 506option is a short form for 507.Fl T Ar utc . 508.Pp 509By default, control characters and non-printable characters are encoded in the output stream. 510In some cases this may make messages less natural in appearance. 511The encoding is designed to preserve all the information in the log message, 512and to prevent malicious users from spoofing or obscuring information in log messages. 513.Pp 514Text in the 515.Dq std , 516.Dq bsd , 517and 518.Dq raw 519formats is encoded as it is by the 520.Nm vis 521utility with the 522.Fl c 523option. 524Newlines and tabs are also encoded as "\\n" and "\\t" respectively. 525In 526.Dq raw 527format, space characters embedded in log message keys are encoded as "\\s" 528and embedded brackets are escaped to print as "\\[" and "\\]". 529.Pp 530XML format output requires that keys are valid UTF8 strings. 531Keys which are not valid UTF8 are ignored, and the associated value is not printed. 532.Pp 533Values that contain legal UTF8 are printed as strings. 534Ampersand, less than, greater than, quotation mark, and apostrophe characters are encoded according to XML conventions. 535Embedded control characters are encoded as 536.Dq &#xNN; 537where NN is the character's hexadecimal value. 538.Pp 539Values that do not contain legal UTF8 are encoded in base-64 and printed as data objects. 540.Pp 541The 542.Fl E Ar format 543option may be used to explicitly control the text encoding. 544The value of 545.Ar format 546may be one of the following: 547.Pp 548.Bl -tag -width "safe" 549.It safe 550This is the default encoding for 551.Nm aslutil 552output. 553Encodes backspace characters as ^H. 554Carriage returns are mapped to newlines. 555A tab character is appended after newlines so that message text is indented. 556.It vis 557The C-style backslash encoding similar to that produced by the 558.Dq vis -c 559command, as described above. 560.It none 561No encoding is used. 562.El 563.Pp 564The intent of the 565.Dq safe 566encoding is to prevent obvious message spoofing or damage. 567The appearance of messages printed will depend on terminal settings and UTF-8 string handling. 568It is possible that messages printed using the 569.Dq safe 570or 571.Dq none 572options may be garbled or subject to manipulation through the use of control characters and control sequences 573embedded in user-supplied message text. 574The 575.Dq vis 576encoding should be used to view messages if there is any suspicion 577that message text may have been used to manipulate the printed representation. 578.Pp 579If no further command line options are specified, 580.Nm 581displays all messages, or copies all messages to a data store file. 582However, an expression may be specified using the 583.Fl k 584and 585.Fl o 586options. 587.Ss EXPRESSIONS 588Expressions specify matching criteria. 589They may be used to search for messages of interest. 590.Pp 591A simple expression 592has the form: 593.Pp 594.Dl -k key [[op] val] 595.Pp 596The 597.Fl k 598option may be followed by one, two, or three arguments. 599A single argument causes a match to occur if a message has the specified key, regardless of value. 600If two arguments are specified, a match occurs when a message has exactly the specified value for a given key. 601For example, to find all messages sent by the portmap process: 602.Pp 603.Dl aslutil -k Sender portmap 604.Pp 605Note that the 606.Fl C 607option is treated as an alias for the expression: 608.Pp 609.Dl -k Facility com.apple.console 610.Pp 611This provides a quick way to search for console messages. 612.Pp 613If three arguments are given, they are of the form 614.Fl k Ar key operation value . 615.Nm 616supports the following matching operators: 617.Pp 618.Bl -tag -width "xxx" -compact 619.It eq 620equal 621.It ne 622not equal 623.It gt 624greater than 625.It ge 626greater than or equal to 627.It lt 628less than 629.It le 630less than or equal to 631.El 632.Pp 633Additionally, the operator may be preceded by one or more of the following modifiers: 634.Pp 635.Bl -tag -width "xxx" -compact 636.It C 637case-fold 638.It R 639regular expression (see 640.Xr regex 3 ) 641.It S 642substring 643.It A 644prefix 645.It Z 646suffix 647.It N 648numeric comparison 649.El 650.Pp 651More complex search expressions may be built by combining two or more simple expressions. 652A complex expression that has more than one 653.Dq -k key [[op] val] 654term matches a message if all of the key-value operations match. 655Logically, the result is an AND of all of key-value operations. 656For example: 657.Pp 658.Dl aslutil -k Sender portmap -k Time ge -2h 659.Pp 660finds all messages sent by portmap in the last 2 hours 661(-2h means "two hours ago"). 662.Pp 663The 664.Fl o 665option may be used to build even more complex searches by providing an OR operation. 666If two or more sub-expressions are given, separated by 667.Fl o 668options, then a match occurs is a message matches any of the sub-expressions. 669For example, to find all messages which have either a 670.Dq Sender 671value of 672.Dq portmap 673or that have a numeric priority level of 4 or less: 674.Pp 675.Dl aslutil -k Sender portmap -o -k Level Nle 4 676.Pp 677Log priority levels are internally handled as an integer value between 0 and 7. 678Level values in expressions may either be given as integers, or as string equivalents. 679See the table string values in the SENDING MESSAGES section for details. 680The example query above could also be specified with the command: 681.Pp 682.Dl aslutil -k Sender portmap -o -k Level Nle warning 683.Pp 684.Pp 685A special convention exists for matching time stamps. 686An unsigned integer value is regarded as the given number of seconds since 6870 hours, 0 minutes, 0 seconds, January 1, 1970, Coordinated Universal Time. 688An negative integer value is regarded as the given number of seconds before the current time. 689For example, to find all messages of Error priority level (3) or less which were logged in the last 30 seconds: 690.Pp 691.Dl aslutil -k Level Nle error -k Time ge -30 692.Pp 693a relative time value may be optionally followed by one of the characters 694.Dq s , 695.Dq m , 696.Dq h , 697.Dq d , 698or 699.Dq w 700to specify seconds, minutes, hours, days, or weeks respectively. 701Upper case may be used equivalently. 702A week is taken to be 7 complete days (i.e. 604800 seconds). 703.Ss FILTERING CONTROLS 704Clients of the Apple System Log facility using either the 705.Xr asl 3 706or 707.Xr syslog 3 708interfaces may specify a log filter mask. 709The mask specifies which messages should be sent to the 710.Nm asld 711daemon by specifying a yes/no setting for each priority level. 712Many clients set a filter mask to avoid sending relatively unimportant messages. 713Debug or Info priority level messages are generally only useful for debugging operations. 714By setting a filter mask, a process can improve performance by avoiding spending 715time sending messages that are in most cases unnecessary. 716.Pp 717The 718.Fl c 719option may be used to control filtering. 720In addition to the internal filter value that processes may set as described above, 721the system maintains a global 722.Dq master 723filter. 724This filter is normally 725.Dq off , 726meaning that it has no effect. 727If a value is set for the master filter, it overrides the local filter for all processes. 728Root user access is required to set the master filter value. 729.Pp 730The current setting of the master filter mask may be inspected using: 731.Pp 732.Dl aslutil -c 0 733.Pp 734The value of the master filter mask my be set by providing a second argument following 735.Fl c Ar 0 . 736The value may a set of characters from the set 737.Dq pacewnid . 738These correspond to the priority levels Emergency (Panic), Alert, Critical, Error, Warning, Notice, Info, and Debug. 739The character 740.Dq x 741may be used for Error, as it is used for sending messages. 742The master filter may be unset with: 743.Pp 744.Dl aslutil -c 0 off 745.Pp 746Since it is common to use the filter as a 747.Dq cutoff 748mechanism, for example to cut off messages with Debug and Info priority, 749a single character from the list above may be specified, preceded by a minus sign. 750In this case, 751.Nm 752uses a filter mask starting at level 0 (Emergency) 753.Dq up to 754the given level. 755For example, to set the master filter level to cause all processes to log messages from Emergency up to Debug: 756.Pp 757.Dl aslutil -c 0 -d 758.Pp 759While the master filter level may be set to control the messages produced by all processes, 760another filter mask may be specified for an individual process. 761If a per-process filter mask is set, it overrides both the local filter mask and the master filter mask. 762The current setting for a per-process filter mask may be inspected using 763.Fl c Ar process , 764where 765.Ar process 766is either a PID or the name of a process. 767If a name is used, it must uniquely identify a process. 768To set a per-process filter mask, an second argument may be supplied following 769.Fl c Ar process 770as described above for the master filter mask. 771Root access is required to set the per-process filter mask for system (UID 0) processes. 772.Pp 773The 774.Nm asld 775server follows filtering rules specified in the /etc/asl.conf file. 776When the remote-control mechanism is used to change the filter of a process, 777.Nm asld 778will save any messages received from that process until the remote-control filter is turned off. 779.Ss SERVER CONFIGURATION 780When 781.Nm asld 782starts up, and when it receives a HUP signal, it re-reads its configuration settings from /etc/asl.conf. 783It is sometimes useful to change configuration parameters temporarily, without needing to make changes 784to the configuration file. 785Any of the configuration options that may be set in the file (following an ``='' character) may also 786be sent to asld using the 787.Fl config 788flag (without an ``='' character). 789For example, to temporarily disable the kernel message-per-second limit: 790.Pp 791.Dl aslutil -config mps_limit 0 792.Pp 793Note that only the superuser (root) may change configuration parameters. 794.Pp 795In addition to the parameter setting options that are described in the 796.Xr asl.conf 5 797manual page, an additional option: 798.Pp 799.Dl aslutil -config reset 800.Pp 801will cause 802.Nm asld 803to reset its configuration. 804.Ss ASL OUTPUT MODULES 805ASL Output Modules are named configuration bundles used by the ASL server 806.Nm asld , 807and by the ASL filesystem manager 808.Nm aslmanager . 809The /etc/asl.conf file represents the system's primary output module, 810and is given the name 811.Dq com.apple.asl . 812Other modules are read from files in the /etc/asl directory. 813File names serve as module names. 814ASL Output Modules are described in detail in 815.Xr asl.conf 5 . 816.Pp 817When invoked with 818.Fl module , 819.Nm asld 820prints a summary of all loaded ASL Output Modules. 821The summary includes the output files and ASL store directories used by each module, 822a list of the module's configuration rules, and the module's current enabled or disabled status. 823.Fl module Ar name 824prints a summary for the module with the given name. 825.Pp 826ASL Output Modules may be enabled or disabled using the command: 827.Pp 828 aslutil -module 829.Ar name 830enable 831.Op 0 832.Pp 833Note that only the superuser (root) may enable or disable a module. 834.Pp 835The name '*' 836(including the single-quote characters) 837may be used to change the status of all ASL Output Modules, 838excluding the primary com.apple.asl module. 839com.apple.asl may be enabled or disabled, but only specifically by name. 840.Pp 841If a module includes rotated files, the command: 842.Pp 843 aslutil -module 844.Ar name 845checkpoint 846.Op file 847.Pp 848Will force the module to checkpoint all of its rotated files, 849or just the single optionally named file. 850The name '*' 851(including the single-quote characters) 852may be used to force checkpointing of all rotated files for all ASL Output Modules, 853including the primary com.apple.asl module. 854.Pp 855Note that only the superuser (root) may force files to be checkpointed. 856.Pp 857The checkpoint action sends a command to 858.Nm asld 859and waits for a reply to be returned. 860This means that any files currently in use will be checkpointed when the 861.Nm aslutil 862command completes. 863.Sh SEE ALSO 864.Xr logger 1 , 865.Xr asl 3 , 866.Xr syslog 3 , 867.Xr asl.conf 5 , 868.Xr asld 8 . 869.Sh HISTORY 870The 871.Nm 872utility appeared as 873.Nm syslog 874in Mac OS X 10.4. 875