Hi guys, i was trying to understand what is the status of the
table. I understand it is deprecated since 10.12 but i still can query it and get data when i try in a 10.14 endpoint. But, is that data reliable? or will I be missing events? Should i be looking at using the trail of bits extension for the time being?
12/15/2020, 11:51 AM
This is really an apple thing. Apple deprecated it. As far as I know it still works.
12/15/2020, 11:57 AM
so do you think all system logs are still going to the ASL?
12/15/2020, 2:16 PM
I don’t know the answer to that
I’d suggest finding apple docs. I’ve love to know what you find
12/15/2020, 2:22 PM
Juan I would definitely not rely on
table and would instead use ToB's Unified Log extension.
12/15/2020, 3:02 PM
Thanks guys for your answers. I have been looking in the apple developer docs, but the ASL seems to be completely gone, just a small note saying that it is superseded by OSLog. We'll consider the extension or maybe wait for the native API. Thanks!