https://github.com/osquery/osquery logo
#macos
Title
# macos
j

Juan Alvarez

12/15/2020, 11:44 AM
Hi guys, i was trying to understand what is the status of the
asl
table. I understand it is deprecated since 10.12 but i still can query it and get data when i try in a 10.14 endpoint. But, is that data reliable? or will I be missing events? Should i be looking at using the trail of bits extension for the time being?
s

seph

12/15/2020, 11:51 AM
This is really an apple thing. Apple deprecated it. As far as I know it still works.
j

Juan Alvarez

12/15/2020, 11:57 AM
so do you think all system logs are still going to the ASL?
s

seph

12/15/2020, 2:16 PM
I don’t know the answer to that
I’d suggest finding apple docs. I’ve love to know what you find
f

fritz

12/15/2020, 2:22 PM
Juan I would definitely not rely on
asl
table and would instead use ToB's Unified Log extension.
j

Juan Alvarez

12/15/2020, 3:02 PM
Thanks guys for your answers. I have been looking in the apple developer docs, but the ASL seems to be completely gone, just a small note saying that it is superseded by OSLog. We'll consider the extension or maybe wait for the native API. Thanks!
g

grahamgilbert

12/15/2020, 3:09 PM