Update macos_unified_logs.yaml

[Pierre-Gronau-ndaal]

Collect macOS Apple System Logs (ASL) files.

[tclahr]

I have tested it on some systems like High Sierra, Monterey and Sonoma, and none of them have asl.db and asl.log files. Can you provide where did you find those files, please? Thanks!

[Pierre-Gronau-ndaal]

ProductName: macOS
ProductVersion: 15.2
BuildVersion: 24C101

sudo ls -la /private/var/log/asl
Password:
total 1160
drwxr-xr-x 18 root wheel 576 14 Jan 00:04 .
drwxr-xr-x 48 root wheel 1536 14 Jan 15:30 ..
-rw-------@ 1 root wheel 27965 7 Jan 23:48 2025.01.07.G80.asl
-rw-------@ 1 root wheel 27038 8 Jan 23:56 2025.01.08.G80.asl
-rw-------@ 1 root wheel 28417 9 Jan 23:52 2025.01.09.G80.asl
-rw-------@ 1 root wheel 30155 10 Jan 23:43 2025.01.10.G80.asl
-rw-------@ 1 root wheel 29846 11 Jan 23:51 2025.01.11.G80.asl
-rw-------@ 1 root wheel 29701 12 Jan 23:52 2025.01.12.G80.asl
-rw-------@ 1 root wheel 25606 13 Jan 23:45 2025.01.13.G80.asl
-rw-------@ 1 root wheel 24586 14 Jan 19:23 2025.01.14.G80.asl
-rw-------@ 1 root wheel 2772 29 Sep 23:03 BB.2025.09.30.G80.asl
-rw-------@ 1 root wheel 26148 21 Okt 08:27 BB.2025.10.30.G80.asl
-rw-------@ 1 root wheel 12301 30 Okt 11:24 BB.2025.10.31.G80.asl
-rw-------@ 1 root wheel 137446 29 Nov 20:38 BB.2025.11.30.G80.asl
-rw-------@ 1 root wheel 127279 29 Dez 22:36 BB.2025.12.31.G80.asl
-rw-------@ 1 root wheel 27605 5 Jan 12:36 BB.2026.01.31.G80.asl
drwxr-xr-x 7 root wheel 224 14 Jan 00:30 Logs
-rw-r--r--@ 1 root wheel 12 14 Jan 19:23 StoreData

[Pierre-Gronau-ndaal]

it have to be older than High Sierra to find

• asl.db
• asl.log

https://superuser.com/questions/104732/system-logs-in-mac-osx-10-6

https://darkdefender.medium.com/brief-introduction-to-macos-forensics-f817c9c83609

as every time: forensic has also to deal with old stuff