Correctly restarting syslog on Mac OS X

For some experimentation, I was recently looking at restarting syslog daemon. I expected it to be as simple as Linux system daemons. The init system of Mac appeared to be more like systemd in my initial searches. A few blogs instructed unload followed by load operation which sounded strange to me.

In systemd parlance, I expected unload operation to disable the daemon from starting up during initial booting. If you try to follow the process suggested in these blogs, you end up with an error stating "Operation not permitted while System Integrity Protection is engaged". This leaves two options:

1. Disable System Integrity Protection
2. Restart the system for every change in config

Of course, the answer is far too simple and none of these complexities need to handled. The right way of restarting the syslog daemon is as follows (using stop and start operations instead of unload and load):

sudo launchctl stop /System/Library/LaunchDaemons/com.apple.syslogd.plist

sudo launchctl start /System/Library/LaunchDaemons/com.apple.syslogd.plist

Getting to know the Syslog protocol

Recently I was looking into FTP issues, when I learnt some details about Syslog. I was using vsftpd for hosting an FTP service. I had enabled logging but I was not seeing anything in journalctl output. The reason for that turned out to be a configuration flaw. I had not turned on the option for vsftpd to use syslog. Once I turned the option on, proper log files were created.

I do not have Syslog-ng or any other syslog package installed. I had uninstalled it when I switched to systemd. So, I had not enabled that option in vsftpd. However, as it turns out when I turn that option on vsftpd uses the syslog protocol for logging. Systemd listens for messages sent using that protocol and creates appropriate logs.

This is a great way of unifying all logging. Individual packages do not have to bother about logging. They just act as clients of the protocol and the listener will take care of maintaining the logs. There are instances of similar architecture being followed for logging in other domains too.

As it turns out, there are standardized versions of the syslog protocol:

• Syslog protocol
• BSD Syslog protocol

The version used commonly is the BSD one even the former is more advanced. Now syslog is being replaced by systemd's journal because it capitalizes over syslog. It provides efficient transfer of binary data and supports JSON. Maintaining logs is much easier.

It was interesting to know that even though syslog packages are becoming obsolete, the syslog protocol is still the logging standard. It is actually a nice example of robust architecture surviving over the years.