asl

Queries the Apple System Log data structure for system events.

Platform support

Please be aware that some queries can only be run against certain platforms. Below is a list of the supported platforms that this query supports. Zercurity will automatically pause queries from running if errors are detected. Running a query against an unsupported platform will result in the following error: no such table: asl

• Mac OSX

Table schema

Name	Type	Description
time	INTEGER	Unix timestamp. Set automatically
time_nano_sec	INTEGER	Nanosecond time.
host	TEXT	Sender’s address (set by the server).
sender	TEXT	Sender’s identification string. Default is process name.
facility	TEXT	Sender’s facility. Default is ‘user’.
pid	INTEGER	Sending process ID encoded as a string. Set automatically.
gid	BIGINT	GID that sent the log message (set by the server).
uid	BIGINT	UID that sent the log message (set by the server).
level	INTEGER	Log level number. See levels in asl.h.
message	TEXT	Message text.
ref_pid	INTEGER	Reference PID for messages proxied by launchd
ref_proc	TEXT	Reference process for messages proxied by launchd
extra	TEXT	Extra columns, in JSON format. Queries against this column are performed entirely in SQLite, so do not benefit from efficient querying via asl.h.

Query examples

Select all the results for the given table.

SELECT * FROM asl;