mac system.log spam control

gistfile1.txt

Noticed /var/log/system.log is a huge file that hasn't rotated for months, and tailing is spammy:

Jul 27 11:17:55 MacMini-2012.local Google Chrome Helper EH[62270]: CFPropertyListCreateFromXMLData(): Old-style plist parser: missing semicolon in dictionary on line 3. Parsing will be abandoned. Break on _CFPropertyListMissingSemicolon to debug.

and

Jul 27 11:18:16 MacMini-2012.local coreaudiod[136]: Disabled automatic stack shots because audio IO is active

I want to tell the system that I permanently don't care about these messages, so let's add
ignore lines at the top of asl.conf.  This is a first-rule type configuration file, so if
we want to not log these anyway the ignore command should be in front. Signal syslogd when
done so it picks up the change.  You should see those messages go away immediately.  I use
the [S= substring match so I don't have to type the whole sender or message exactly, so
think about precision of your ignore filter here.

$ sudo vim /etc/asl.conf
# S= means substring match
? [S= Sender Google Chrome] [S= Message CFPropertyListCreateFromXMLData] ignore
? [S= Sender coreaudiod] [S= Message automatic stack shots] ignore

$ sudo killall -HUP syslogd


Now let's deal with the other issue, which is that system.log isn't rolling over.  It turns
out that the default is to roll over system.log every midnight.  Of course, most Macs are
asleep at midnight so this seems like a bug.  Let's fix it so that system.log is rolled over
just like the other logs here, when it gets to 1 Meg in size.  No need to run newsyslog or
signal for a config change, it'll pick it up next run.

$ sudo vim /etc/newsyslog.conf
#/var/log/system.log  		640  7	   *	@T00  J
# dab changed to work on a system that sleeps
/var/log/system.log			640  7	   1000	*  J

Much better!