Background

It is often desirable to collect the system logs from various devices onto a central “logging host”.  This can simplify monitoring needs considerably as tools and scripts need only work on a single host.  It also provides some security benefits as hackers will have a harder time masking their activities if they do not have access to the logging host.

On Mac OS X, there is a logging daemon (the Unix standard syslogd utility) that can be used to write both local logs and receive logs from remote hosts.  Unfortunately, the ability to receive remote logs is turned off in the default installation.  However, it is a trivial task to enable this functionality.

Setup (for 10.5 and older systems)

1. Login as administrator to the logging host
2. Open a terminal session using the Terminal utility
3. Navigate to the LaunchDaemons directory
   cd /System/Library/LaunchDaemons
4. Edit the com.apple.syslogd.plist file
   sudo vi com.apple.syslogd.plist
5. Remove the comment delimiters (<!-- and -->) surrounding the NetworkListener block and save the changes
   

   <!--
    <key>NetworkListener</key>
    <dict>
    <key>SockServiceName</key>
    <string>syslog</string>
    <key>SockType</key>
    <string>dgram</string>
    </dict>
   -->

6. Stop the currently running instance of the syslog daemon
   sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist
7. Restart the syslog daemon to pick up the changes in the LaunchDaemon configuration
   sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist

The logging facility on the log host should now be available for remote devices to use.

Setup (for 10.6 and later systems)

1. Login as administrator to the logging host
2. Open a terminal session using the Terminal utility
3. Navigate to the LaunchDaemons directory
   cd /System/Library/LaunchDaemons
4. Convert the com.apple.syslogd.plist to XML format
   sudo plutil -convert xml1 com.apple.syslogd.plist
5. Edit the com.apple.syslogd.plist file
   sudo vi com.apple.syslogd.plist
6. Add the NetworkListener dict entry after the end of the BSDSystemLogger dict entry and save the changes
   

   <key>NetworkListener</key>
   <dict>
   <key>SockServiceName</key>
   <string>syslog</string>
   <key>SockType</key>
   <string>dgram</string>
   </dict>

7. Convert the com.apple.syslogd.plist file back to the binary format
   sudo plutil -convert binary1 com.apple.syslogd.plist
8. Stop the currently running instance of the syslog daemon
   sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist
9. Restart the syslog daemon to pick up the changes in the LaunchDaemon configuration
   sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist

The logging facility on the log host should now be available for remote devices to use.

Setup (using the Property List Editor)

Apple provides the Property List Editor utility as part of its developer tools.  The developer tools are usually a separate install from the operating system and is frequently not installed on systems.  If it is present, then using the Property List Editor may be the most convenient means of modifying the com.apple.syslogd.plist file.

1. Login as administrator to the logging host
2. Launch the Property List Editor utility (typically located in /Developer/Applications/Utilities)
3. Open the /System/Library/LaunchDaemons/com.apple.syslogd.plist file
4. Select the “Sockets” dictionary entry and “Add Item” to create a new key in the “Sockets” dictionary
5. Change the name of the item to “NetworkListener” and set its type to “Dictionary”
6. Select the “NetworkListener” dictionary entry and “Add Item” to create a new key in the “NetworkListener” dictionary
7. Change the name of the item to “SockServiceName”, its type to “String” and its value to “syslog”
8. Select the “NetworkListener” dictionary entry and “Add Item” to create another new key in the “NetworkListener” dictionary
9. Change the name of the item to “SockType”, its type to “String”, and its value to “dgram”
10. Save the file and quit the Property List Editor utility.  The property list should resemble the following example:
11. Open a terminal session using the Terminal utility
12. Navigate to the LaunchDaemons directory
    cd /System/Library/LaunchDaemons
13. Stop the currently running instance of the syslog daemon
    sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist
14. Restart the syslog daemon to pick up the changes in the LaunchDaemon configuration
    sudo launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist