How to access OSLogEnumerator (Request for help, not an issue)

[andrewdavidmackenzie]

Sorry to create an issue when I'm just asking for help, but wanted to reach out with a question:

I'd like to write a small rust program to access the unified logging output ("log" command on macos) by accessing the OSLogEnumerator objective C class.

Any hints on how I could go about that, or any existing core that does (so I don't re-invent the wheel).

Thanks

[simlay]

I'll admit that I'm not sure how to actually get an instance of a OSLogEnumerator but the objc2_os_log crate has bindings to the OSLogEnumerator. Looking around github, I think OSLogStore::entriesEnumeratorWithOptions_position_predicate_error might be what you're looking for.

There is also tracing-oslog and oslog. I have used oslog with the unified logging system on an iPhone device before. I believe that bevy uses tracing-oslog.

[andrewdavidmackenzie]

Thanks.

I think tracing-oslog and oslog are just for output of logs to the Unified Logging, not for querying of it?

objc2_os_log crate has bindings to the OSLogEnumerator does look like what I want, I'll see if I can figure out how to use it!

First attempt led to a segfault (not a panic!), so got some work to do in learning to use these crates! :-)

fn main() {
    let oslog = unsafe { OSLogStore::new() };
    
    let predicate = unsafe { NSPredicate::new() };
    
    let entries = unsafe { oslog.entriesEnumeratorWithOptions_position_predicate_error(
        OSLogEnumeratorOptions(0), 
        None, 
        Some(&predicate)
    ) }.unwrap();
}

I'll try to construct a real predicate and see if that helps

[simlay]

I also just tried this. OSLogStore::new() is a short hand to init and alloc but init is deprecated. I also got the segfault a few times. Here's what I got working:

use objc2_os_log::{OSLogStore, OSLogStoreScope};
fn main() -> Result<(), Box<dyn std::error::Error>> {
    let log_store = unsafe { OSLogStore::storeWithScope_error(OSLogStoreScope::System)};
    println!("LOG STORE: {log_store:?}");
    let log_store = log_store.unwrap();

    println!("BEFORE enumerator");
    let enumerator = unsafe {log_store.entriesEnumeratorAndReturnError() };

    println!("LOG STORE ENUMERATOR: {log_store:?}");
    let enumerator = enumerator.unwrap();
    for i in enumerator.iter() {
        println!("{:?}", i);
    }
    Ok(())
}

[andrewdavidmackenzie]

That worked! Thanks!

I'm using a predicate and it's working.

BTW: To etect when web cam is switched on and off

[simlay]

Nice!

[andrewdavidmackenzie]

Now need to figure out how to work with AnyObject, or cast it to something useful, or maybe as a String is the best I can do?

[simlay]

It took me a while to figure out what the AnyObject in the enumeration but it's an OSLogEntry. This spits out a bunch of stuff:

use objc2_os_log::{OSLogStore, OSLogStoreScope, OSLogEntry};
use objc2_foundation::{NSDate, NSPredicate, NSString};
fn main() -> Result<(), Box<dyn std::error::Error>> {
    let log_store = unsafe { OSLogStore::storeWithScope_error(OSLogStoreScope::System)};
    println!("LOG STORE: {log_store:?}");
    let log_store = log_store.unwrap();

    println!("BEFORE enumerator");
    let enumerator = unsafe {log_store.entriesEnumeratorAndReturnError() };

    println!("LOG STORE ENUMERATOR: {log_store:?}");
    let enumerator = enumerator.unwrap();
    for obj in enumerator.iter() {
        let entry = obj.downcast::<OSLogEntry>().unwrap();
        println!("{:?}", unsafe{ entry.composedMessage()});
    }
    Ok(())
}

[andrewdavidmackenzie]

I knew the type, but didn't know how to do the casting!

BTW: If you comment out the println!(), do you still get output from the log system on the terminal?

[simlay]

BTW: If you comment out the println!(), do you still get output from the log system on the terminal?

Huh. yeah looks like stderr is getting this:

Wall Clock adjustment detected - results might be strange while using --end

[andrewdavidmackenzie]

Yeh, apart from that line on stderr, if I use a valid predicate:

e.g. r#"(eventMessage == "AppleH13CamIn::power_on_hardware" || eventMessage == "AppleH13CamIn::power_off_hardware")"#

then I get the log entries output (not sure yet if stdout or stderr) even when I remove my println!().

[andrewdavidmackenzie]

It's weird.

I get the output of matches to the predicate, no matter what I do (no println!()), and I cannot get an iterator on the entry to work, it's like it blocks on the enumerator.iter()

https://github.com/andrewdavidmackenzie/trackers/blob/master/src/main.rs

[madsmtm]

I get the output of matches to the predicate, no matter what I do (no println!()), and I cannot get an iterator on the entry to work, it's like it blocks on the enumerator.iter()

I'm not sure I understand the sentence, could you expand on what's wrong?

stdout/stderr

Might be a bug in macOS 15? I'm on macOS 14.7.4, and using NSPredicate::predicateWithValue(true) without the println!(), I'm not seeing any output?

[andrewdavidmackenzie]

If I run my binary in a terminal, it can get the desired logs via code and do whatever it wants with them, but ALSO they are printed to stout/stderr of the terminal (but not printed by my binary).

…

On Fri, Aug 15, 2025, 3:18 AM Mads Marquart ***@***.***> wrote: *madsmtm* left a comment (madsmtm/objc2#769) <#769 (comment)> I get the output of matches to the predicate, no matter what I do (no println!()), and I cannot get an iterator on the entry to work, it's like it blocks on the enumerator.iter() I'm not sure I understand the sentence, could you expand on what's wrong? stdout/stderr Might be a bug in macOS 15? I'm on macOS 14.7.4, and using NSPredicate::predicateWithValue(true) without the println!(), I'm not seeing any output? — Reply to this email directly, view it on GitHub <#769 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABKF4LAQ6AUAPIJ7M5WHB6D3NU7Q5AVCNFSM6AAAAACA233RKGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTCOJQGQYTSNZQGE> . You are receiving this because you authored the thread.Message ID: ***@***.***>