Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Configuring Syslog on Your Apple Mac OS X

You can configure syslog on systems that run Apple Mac OS X operating systems by using a log stream script to send the MAC system logs to JSA.

  1. To implement the 7.3-JSA-JSASCRIPT-logStream-1.0 fix, download the following files from
  2. Create an executable shell script with an .sh extension with the following naming convention:


  3. Add the following command to the file that you created:

    #!/bin/sh /Users/<PathToPer1Script> -<Parameters1> <Value> - <Parameters2> <Value2>

    The path is an absolute path that usually starts from /Users/....

    You can use the following parameters for

    Table 1: Parameters




    The -H parameter defines the host name or IP to send the logs to.


    The -p parameter defines the port on the remote host, where a syslog receiver is listening.

    If this parameter is not specified, by default the script uses the TCP port 514 for sending events to JSA.


    The -O parameter overrides the automatic host name from the OS's /bin/hostname command.


    The syslog header format default is 5424 (RFC5424 time stamp), but 3339 can be specified instead to output the time stamp in RFC3389 format.


    The -u parameter forces logStream to send events by using UDP.


    The -v parameter displays the version information for the logStream.


    The -x parameter is an exclusion filter in grep extended Regex format.


    Includes identity?


    Includes custom properties?


    More information

    Ambiron website (

  4. Save your changes.
  5. From the terminal, go to the folder that contains the shell file that you created.
  6. To make the perl file an executable file, type the following command:

    chmod +x <FILE_NAME>.sh

  7. In the terminal, create a file with a .plist file extension as in the following example:


  8. Add the following XML command to the file:

    <?xml version="1.0" encoding=”UTF-8”> <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www”><plist version="1.0> <dict> <key>Label>/key> <string></string> <key>Program</key> <string>/Users/...<Path_to_Shell_Script_Created_In_Step1>.../</string> <key>RunAtLoad</key> <true/> </dict> </plist>

    The XML command holds data in key-value pair. The following table provides the key-value pairs:

    Table 2: Key-value Pairs





    /Users/...<Path_To_Shell_ Script_Created_In Step1>.../



    The value of the Label key must be unique for each .plist file. For example, if you use the Label value for one .plist file, you can't use the same value for another .plist file.

    The Program key holds the path of the shell script that you want to run. The path is an absolute path that usually starts from /Users/....

    The RunAtLoad key shows events when you want to run your shell program automatically.

  9. Save your changes.
  10. To make the .plist file an executable file, type the following command:

    chmod +x <fileName>.plist

  11. Copy the file to /Library/LaunchDaemons/ by using the following command:

    sudo cp <Path_To_Your_plist_file>/Library/LaunchDaemons/

  12. Restart your Mac system.
  13. Log in to JSA, and then from the Log Activity tab, verify that events are arriving from the Apple Mac system. If events are arriving as Sim Generic, you must manually configure a log source for the Apple Mac system.

    The log source parameter values for that event are:

    Table 3: Log Source Parameters



    Log Source Type

    Apple Mac OS X

    Protocol Configuration


    Log Source Identifier