in Lib/Collectors/EventLogCollector.cs [104:184]
public void ExecuteMacOs(CancellationToken cancellationToken)
{
// New log entries start with a timestamp like so: 2019-09-25 20:38:53.784594-0700 0xdbf47 Error
// 0x0 0 0 kernel: (Sandbox) Sandbox: mdworker(15726) deny(1) mach-lookup com.apple.security.syspolicy
Regex MacLogHeader = new Regex("^([0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9] [0-2][0-9]:[0-5][0-9]:[0-5][0-9]).*?0x[0-9a-f]*[\\s]*([A-Za-z]*)[\\s]*0x[0-9a-f][\\s]*[0-9]*[\\s]*([0-9]*)[\\s]*(.*?):(.*)", RegexOptions.Compiled);
EventLogObject? curObject = null;
using var process = new Process()
{
StartInfo = new ProcessStartInfo
{
FileName = "log",
Arguments = opts.GatherVerboseLogs ? "show" : "show --predicate \"messageType == 16 || messageType == 17\"",
RedirectStandardOutput = true,
RedirectStandardError = true,
UseShellExecute = false,
CreateNoWindow = true,
WindowStyle = ProcessWindowStyle.Hidden
}
};
var stdError = new StringBuilder();
process.ErrorDataReceived += (sender, args) => stdError.AppendLine(args.Data);
try
{
process.Start();
//Throw away header
process.StandardOutput.ReadLine();
while (!process.StandardOutput.EndOfStream)
{
if (cancellationToken.IsCancellationRequested)
{
break;
}
var evt = process.StandardOutput.ReadLine();
if (evt != null && MacLogHeader.IsMatch(evt))
{
if (curObject != null)
{
HandleChange(curObject);
}
curObject = new EventLogObject(evt)
{
Level = MacLogHeader.Matches(evt).Single().Groups[2].Value,
Summary = $"{MacLogHeader.Matches(evt).Single().Groups[4].Captures[0].Value}:{MacLogHeader.Matches(evt).Single().Groups[5].Captures[0].Value}",
Source = MacLogHeader.Matches(evt).Single().Groups[4].Captures[0].Value,
};
if (DateTime.TryParse(MacLogHeader.Matches(evt).Single().Groups[1].Captures[0].Value, out DateTime Timestamp))
{
curObject.Timestamp = Timestamp;
}
}
else
{
if (curObject != null)
{
if (evt != null)
{
if (curObject.Data == null)
{
curObject.Data = new List<string>();
}
curObject.Data.Add(evt);
}
}
}
}
process.WaitForExit();
if (curObject != null)
{
HandleChange(curObject);
}
}
catch (Exception e)
{
Log.Debug(e, "Failed to gather event logs on Mac OS. {0}", stdError);
}
}