Millisecond precision in syslogd on OS X

Question

When I log messages to syslog in OS X (10.10.1), it truncates the timestamp to the second. If I log to a file, for example, I am able to capture milliseconds. Milliseconds matter when logs are coming fast and furiously. Any idea if there’s a way to set millisecond precision in the OS X implementation of syslogd?

Answer 1

OS X's syslogd stores log events in the "Apple System Log" (asl) database/store with microsecond precision by default, with provisions for nanosecond precision.

However, when that data gets copied out into traditional flat log files like /var/log/system.log, the traditional to-the-second timestamp format are used, because that's what those flat log files have always used.

You can use the syslog command-line tool to query the asl database, and you can specify the format of the output with various command-line options including -F. For example, to dump everything from the asl database in standard log file format, but with microsecond precision, do this:

syslog -F std.6

Note that if you have a process logging so many messages to syslog so fast that sub-second timestamps matter, you might want to also look at the asl.conf(5) man page to make sure your mps_limit and dup_delay parameters are set in such a way that all your log messages actually get stored in the database, as opposed to being throttled or thrown out.