does osquery have a table for Mac OS `os log ` logging

Question

Mike Myers · Answer

I think that goes to the Unified Log System so no Because reading from that would require an API Apple provides none or forking execution to call the Apple CLI utility osquery design philosophy is to not fork or spawn other processes

Mike Myers · Answer

Mike Myers · Answer

But we did create an osquery extension to read it <https github com trailofbits osquery extensions tree master darwin unified log>

Lawrence D&apos;Anna · Answer

thanks slightly smiling face

Lawrence D&apos;Anna · Answer

OSLog framework doesn t have whats needed <https developer apple com documentation oslog>

Mike Myers · Answer

oh what s this is this new I see `macOS 10 15+`

Lawrence D&apos;Anna · Answer

yea first appeared in 10 15 i think

Mike Myers · Answer

I see the earliest examples I can find from around November 2019 that s cool I will go update our issue on this An osquery table is now possible in core Although it looks like there might be an entitlement required which means code signing etc