Mac OS X Sierra - How to get all logs from the Unified Log database?

[managed_securit]

Couldn't find a similar question to this one. How are people retrieving logs from Mac OS X Sierra that are in the Unified Logging Database? This was a new logging technology released with Sierra (think it's stored in a binary database). It has way better and more detailed logs compared to the deprecated system.log file. There is practically nothing going to the system.log file in newer OS X versions... Ideally, I'd like to output data from the database and append it to the system.log file so it can get picked up with the rest of our old fashioned syslog (and be forwarded by using an old fashioned forwarding server over udp:514.) The asl.conf appears to be superseded by the Unified Logging as well. Any ideas?

[johanwalles]

@yannK, when do you think Splunk will get built-in support for ingesting logs from OS X Sierra and above?

[managed_securit]

I was afraid this might be the answer. In our current case we prefer to have real-time logs so that we could use some alerting. Having a script running a tail on the logs output is not ideal, but something I had thought of.

I'm reading your info on modular inputs, but it's a little confusing. I don't see a difference between using that vs a shell script.

[chris]

Hi managed_security what did you end up setting up? Any chance that you could share a modular input if you set on up?