asl

Queries the Apple System Log data structure for system events.

Platform support

Please be aware that some queries can only be run against certain platforms. Below is a list of the supported platforms that this query supports. Zercurity will automatically pause queries from running if errors are detected. Running a query against an unsupported platform will result in the following error: no such table: asl

  • Mac OSX

Table schema

Name

Type

Description

time

INTEGER

Unix timestamp. Set automatically

time_nano_sec

INTEGER

Nanosecond time.

host

TEXT

Sender’s address (set by the server).

sender

TEXT

Sender’s identification string. Default is process name.

facility

TEXT

Sender’s facility. Default is ‘user’.

pid

INTEGER

Sending process ID encoded as a string. Set automatically.

gid

BIGINT

GID that sent the log message (set by the server).

uid

BIGINT

UID that sent the log message (set by the server).

level

INTEGER

Log level number. See levels in asl.h.

message

TEXT

Message text.

ref_pid

INTEGER

Reference PID for messages proxied by launchd

ref_proc

TEXT

Reference process for messages proxied by launchd

extra

TEXT

Extra columns, in JSON format. Queries against this column are performed entirely in SQLite, so do not benefit from efficient querying via asl.h.

Query examples

Select all the results for the given table.

SELECT * FROM asl;