https://github.com/osquery/osquery logo
Title
l

Lawrence D'Anna

04/29/2020, 9:43 PM
does osquery have a table for Mac OS
os_log()
logging?
m

Mike Myers

05/04/2020, 9:15 PM
I think that goes to the Unified Log System, so, no. Because reading from that would require an API (Apple provides none) or forking execution to call the Apple CLI utility (osquery design philosophy is to not fork or spawn other processes)
l

Lawrence D'Anna

05/04/2020, 9:18 PM
thanks 🙂
OSLog.framework doesn’t have whats needed? https://developer.apple.com/documentation/oslog
:awesome: 1
m

Mike Myers

05/04/2020, 9:44 PM
oh what's this, is this new? I see
macOS 10.15+
l

Lawrence D'Anna

05/04/2020, 9:45 PM
yea, first appeared in 10.15 i think
m

Mike Myers

05/04/2020, 9:48 PM
I see the earliest examples I can find from around November 2019, that's cool, I will go update our issue on this. An osquery table is now possible in core. Although it looks like there might be an entitlement required, which means code-signing etc