You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Collect logs on system sudo log collect. This should output system_logs.logarchive
Examine the contents of system_logs.logarchive and delete all logs in Persist and Signpost directories. This will make parsing even faster
Run latest version of unifiedlog_parser example
Review output.csv for any results with: Unsupported Statedump object: DNS Configuration-AAAA.... or Unsupported Statedump object: Network information-AQYXIAQAAA...
The log command can be used to further examine the collected logarchive
Expected behavior macos-unifiedlogs parses the custom objects correctly
Actual behavior
Currently we just base64 encode the data
The text was updated successfully, but these errors were encountered:
For parsing these objects it will likely require another decoder under src/decoders/
Since these objects are part of the configd daemon, probably best to put them in a separate file like decoders/configs.rs
Describe the issue
While reviewing statedump events, two new custom objects were identified:
These events show up when the statedump event type is 3 (which is custom object)
Both seem to be part of macOS configd daemon.
dnsinfo seems to be a structure containing
dns_config_t
informationhttps://opensource.apple.com/source/configd/configd-596.12/dnsinfo/dnsinfo.h.auto.html
Brief snippet
nwi
I have not looked into much but appears to contain info about the network interfaceFurther info about this structure might found under:
https://opensource.apple.com/source/configd/configd-1109.60.2/nwi/
Brief snippet:
Steps to quickly reproduce:
sudo log collect
. This should outputsystem_logs.logarchive
system_logs.logarchive
and delete all logs in Persist and Signpost directories. This will make parsing even fasterunifiedlog_parser
exampleoutput.csv
for any results with:Unsupported Statedump object: DNS Configuration-AAAA....
orUnsupported Statedump object: Network information-AQYXIAQAAA...
The
log
command can be used to further examine the collected logarchiveExpected behavior
macos-unifiedlogs
parses the custom objects correctlyActual behavior
Currently we just base64 encode the data
The text was updated successfully, but these errors were encountered: