public void ExecuteMacOs()

in Lib/Collectors/EventLogCollector.cs [104:184]


        public void ExecuteMacOs(CancellationToken cancellationToken)
        {
            // New log entries start with a timestamp like so: 2019-09-25 20:38:53.784594-0700 0xdbf47 Error
            // 0x0 0 0 kernel: (Sandbox) Sandbox: mdworker(15726) deny(1) mach-lookup com.apple.security.syspolicy
            Regex MacLogHeader = new Regex("^([0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9] [0-2][0-9]:[0-5][0-9]:[0-5][0-9]).*?0x[0-9a-f]*[\\s]*([A-Za-z]*)[\\s]*0x[0-9a-f][\\s]*[0-9]*[\\s]*([0-9]*)[\\s]*(.*?):(.*)", RegexOptions.Compiled);
            EventLogObject? curObject = null;

            using var process = new Process()
            {
                StartInfo = new ProcessStartInfo
                {
                    FileName = "log",
                    Arguments = opts.GatherVerboseLogs ? "show" : "show --predicate \"messageType == 16 || messageType == 17\"",
                    RedirectStandardOutput = true,
                    RedirectStandardError = true,
                    UseShellExecute = false,
                    CreateNoWindow = true,
                    WindowStyle = ProcessWindowStyle.Hidden
                }
            };

            var stdError = new StringBuilder();
            process.ErrorDataReceived += (sender, args) => stdError.AppendLine(args.Data);
            try
            {
                process.Start();
                //Throw away header
                process.StandardOutput.ReadLine();

                while (!process.StandardOutput.EndOfStream)
                {
                    if (cancellationToken.IsCancellationRequested)
                    {
                        break;
                    }
                    var evt = process.StandardOutput.ReadLine();

                    if (evt != null && MacLogHeader.IsMatch(evt))
                    {
                        if (curObject != null)
                        {
                            HandleChange(curObject);
                        }

                        curObject = new EventLogObject(evt)
                        {
                            Level = MacLogHeader.Matches(evt).Single().Groups[2].Value,
                            Summary = $"{MacLogHeader.Matches(evt).Single().Groups[4].Captures[0].Value}:{MacLogHeader.Matches(evt).Single().Groups[5].Captures[0].Value}",
                            Source = MacLogHeader.Matches(evt).Single().Groups[4].Captures[0].Value,
                        };
                        if (DateTime.TryParse(MacLogHeader.Matches(evt).Single().Groups[1].Captures[0].Value, out DateTime Timestamp))
                        {
                            curObject.Timestamp = Timestamp;
                        }
                    }
                    else
                    {
                        if (curObject != null)
                        {
                            if (evt != null)
                            {
                                if (curObject.Data == null)
                                {
                                    curObject.Data = new List<string>();
                                }
                                curObject.Data.Add(evt);
                            }
                        }
                    }
                }
                process.WaitForExit();
                if (curObject != null)
                {
                    HandleChange(curObject);
                }
            }
            catch (Exception e)
            {
                Log.Debug(e, "Failed to gather event logs on Mac OS. {0}", stdError);
            }
        }