Apple System Logs (ASL)

Overview

Evidence: Apple System Logs (ASL) Description: Collect Apple System Logs (ASL) Category: System Platform: macos Short Name: asl Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Apple System Logs (ASL) provide historical system and application log entries prior to Unified Logging. This data is essential for legacy system investigations and timeline reconstruction.

Data Collected

This collector gathers structured data about apple system logs (asl).

Apple System Logs (ASL) Data

Field	Description	Example
PID	PID	123
Sender	Sender	Example value
Facility	Facility	Example value
Message	Message	Example value
Level	Level	Example value
Time	Time	2023-10-15 14:30:25+03:00

Collection Method

This collector copies /private/var/log/asl/*.asl files, converts them via syslog -f -F xml, and records entries into asl.

Forensic Value

This evidence is crucial for forensic investigations as it can reveal authentication events, errors, and system activities captured by ASL.