Skip to content

Commit 00df5f2

Browse files
joachimmetzjoachimmetz
committed
Worked on Apple Unified Logging format support
1 parent da0f293 commit 00df5f2

File tree

4 files changed

+642
-116
lines changed

4 files changed

+642
-116
lines changed

‎documentation/Apple Unified Logging and Activity Tracing formats.asciidoc

Lines changed: 189 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -778,8 +778,9 @@ Contains a 32-bit value
778778
| 0x02 | | [yellow-background]*Unknown (integer)* +
779779
Contains a 8-bit, 16-bit, 32-bit or 64-bit value
780780
3+|
781-
| 0x12 | | [yellow-background]*Unknown* +
782-
Contains a 32-bit value
781+
| 0x12 | | [yellow-background]*Unknown (format string precision)* +
782+
Contains a 32-bit value +
783+
This value has been seen to be used in combination with format strings like "%.16s" and "%.*s", where this value contains the number of characters of the string that should be printed.
783784
3+|
784785
| 0x20 | | [yellow-background]*Unknown (string)* +
785786
Consists of a <<tracev3_firehose_tracepoint_data_time_with_value_data_range,Firehose tracepoint string data item>> where the value data contains an UTF-8 encoded string with an optional end-of-string character.
@@ -802,12 +803,12 @@ Consists of a <<tracev3_firehose_tracepoint_data_time_with_value_data_range,Fire
802803
| 0x40 | | [yellow-background]*Unknown (string)* +
803804
Consists of a <<tracev3_firehose_tracepoint_data_time_with_value_data_range,Firehose tracepoint string data item>> where the value data contains an UTF-8 encoded string with an optional end-of-string character.
804805
| 0x41 | | [yellow-background]*Unknown (private string)* +
805-
Contains a 32-bit value
806+
Contains a 32-bit value, formatted as "<private>"
806807
| 0x42 | | [yellow-background]*Unknown (string)* +
807808
Consists of a <<tracev3_firehose_tracepoint_data_time_with_value_data_range,Firehose tracepoint string data item>> where the value data contains an UTF-8 encoded string with an optional end-of-string character.
808809
3+|
809-
| 0xf2 | | [yellow-background]*Unknown (UUID)*
810-
Consists of a <<tracev3_firehose_tracepoint_data_time_with_value_data_range,Firehose tracepoint string data item>> where the value data contains an UUID.
810+
| 0xf2 | | [yellow-background]*Unknown (binary data)* +
811+
Consists of a <<tracev3_firehose_tracepoint_data_time_with_value_data_range,Firehose tracepoint string data item>> where the value data contains binary data.
811812
|===
812813

813814
===== [[tracev3_firehose_tracepoint_data_time_with_value_data_range]]Firehose tracepoint data item with value data range
@@ -1020,33 +1021,77 @@ The built-in value type decoders are:
10201021
[cols="1,1,5",options="header"]
10211022
|===
10221023
| Value | Identifier | Description
1023-
| "{bitrate}" | | Formatted as a bit-rate value, for example "123 kbps"
1024-
| "{bool}" | | Formatted as a lower-case boolean value, for example "true" or "false"
1025-
| "{BOOL}" | | Formatted as a uppoer-case boolean value, for example "YES" or "NO"
1026-
| "{bytes}" | | Formatted a bytes value, for example "4.72 kB"
1027-
| "{darwin.errno}" | | Formatted as a system error, for example "[32: Broken pipe]"
1028-
| "{darwin.mode}" | | Formatted as a file mode value, for example "drwxr-xr-x"
1029-
| "{darwin.signal}" | | Formatted as a signal, for example "[sigsegv: Segmentation Fault]"
1030-
| "{errno}" | | Formatted as a system error, for example "[32: Broken pipe]"
1031-
| "{iec-bitrate}" | | Formatted as an IEC bit-rate value, for example "118 Kibps"
1032-
| "{iec-bytes}" | | Formatted as IEC bytes value, for example "4.61 KiB"
1033-
| "{in_addr}" | | Formatted as an IPv4 address, for example "127.0.0.1"
1034-
| "{in6_addr}" | | Formatted as an IPv6 address, for example "fe80::f:86ff:fee9:5c16"
1035-
| "{private}" | | Private log argument
1036-
| "{public}" | | Public log argument
1037-
| "{sockaddr}" | | Formatted as socket address, for example "fe80::f:86ff:fee9:5c16"
1038-
| "{time_t}" | | Formatted as a seconds precision date and time value, for example "2016-01-12 19:41:37"
1039-
| "{timespec}" | | Formatted as a nanoseconds precision date and time value, for example "2016-01-12 19:41:37.2382382823"
1040-
| "{timeval}" | | Formatted as a microseconds precision date and time value, for example "2016-01-12 19:41:37.774236"
1041-
| "{uuid_t}" | | Formatted as an UUID, for example "10742E39-0657-41F8-AB99-878C5EC2DCAA"
1024+
| "bitrate" | | Formatted as a bit-rate value, for example "123 kbps"
1025+
| "bool" | | Formatted as a lower-case boolean value, for example "true" or "false"
1026+
| "BOOL" | | Formatted as a uppoer-case boolean value, for example "YES" or "NO"
1027+
| "bytes" | | Formatted a bytes value, for example "4.72 kB"
1028+
| "darwin.errno" | | Formatted as a system error, for example "[32: Broken pipe]"
1029+
| "darwin.mode" | | Formatted as a file mode value, for example "drwxr-xr-x"
1030+
| "darwin.signal" | | Formatted as a signal, for example "[sigsegv: Segmentation Fault]"
1031+
| "iec-bitrate" | | Formatted as an IEC bit-rate value, for example "118 Kibps"
1032+
| "iec-bytes" | | Formatted as IEC bytes value, for example "4.61 KiB"
1033+
| "in_addr" | | Formatted as an IPv4 address, for example "127.0.0.1"
1034+
| "in6_addr" | | Formatted as an IPv6 address, for example "fe80::f:86ff:fee9:5c16"
1035+
| "sockaddr" | | Formatted as socket address, for example "fe80::f:86ff:fee9:5c16"
1036+
| "time_t" | | Formatted as a seconds precision date and time value, for example "2016-01-12 19:41:37"
1037+
| "timespec" | | Formatted as a nanoseconds precision date and time value, for example "2016-01-12 19:41:37.2382382823"
1038+
| "timeval" | | Formatted as a microseconds precision date and time value, for example "2016-01-12 19:41:37.774236"
1039+
| "uuid_t" | | Formatted as an UUID, for example "10742E39-0657-41F8-AB99-878C5EC2DCAA"
1040+
|===
1041+
1042+
Other observerd value type decoders are:
1043+
1044+
[cols="1,1,5",options="header"]
1045+
|===
1046+
| Value | Identifier | Description
1047+
| "errno" | | Formatted as a system error, for example "[32: Broken pipe]"
1048+
| "location:_CLClientManagerStateTrackerState" | | Formatted as a <<core_location_client_manager_state_tracker_state,Core location client manager (CLClientManager) state tracker state>>
1049+
| "location:_CLLocationManagerStateTrackerState" | | Formatted as a <<core_location_location_manager_state_tracker_state,Core location location manager (CLLocationManager) state tracker state>>
1050+
| "location:CLClientAuthorizationStatus" | |
1051+
| "location:CLDaemonStatus_Type::Reachability" | |
1052+
| "location:CLSubHarvesterIdentifier" | |
1053+
| "location:escape_only" | |
1054+
| "location:IOMessage" | |
1055+
| "location:SqliteResult" | |
1056+
| "mask.hash" | | Formatted as "<mask.hash: '%s'>" where "%s" contains the base64 encoded value.
1057+
| "mdns:acceptable" | |
1058+
| "mdns:addrmv" | |
1059+
| "mdns:dns.counts" | |
1060+
| "mdns:dns.idflags" | |
1061+
| "mdns:dnshdr" | |
1062+
| "mdns:gaiopts" | |
1063+
| "mdns:nreason" | |
1064+
| "mdns:protocol" | |
1065+
| "mdns:rd.svcb" | |
1066+
| "mdns:rrtype" | |
1067+
| "mdns:yesno" | |
1068+
| "mdnsresponder:domain_name" | |
1069+
| "mdnsresponder:ip_addr" | |
1070+
| "mdnsresponder:mac_addr" | |
1071+
| "network:in_addr" | |
1072+
| "network:in6_addr" | |
1073+
| "network:sockaddr" | |
1074+
| "network:tcp_flags" | |
1075+
| "network:tcp_state" | |
1076+
| "odtypes:ODError" | |
1077+
| "odtypes:mbr_details" | |
1078+
| "odtypes:mbridtype" | |
1079+
| "odtypes:nt_sid_t" | |
1080+
| "sensitive" | |
1081+
| "private" | | Private log argument
1082+
| "public" | | Public log argument
10421083
|===
10431084

1085+
[NOTE]
1086+
The multiple value type decoders can be used in combination for example
1087+
"%{public,uuid_t}.16P" or "%{private, mask.hash, mdnsresponder:ip_addr}.20P".
1088+
10441089
The flags are defined as:
10451090

10461091
[cols="1,1,5",options="header"]
10471092
|===
10481093
| Value | Identifier | Description
1049-
| "#" | |
1094+
| "#" | | Value should be converted to an "alternate form"
10501095
| "0" | | Value should be padded with 0
10511096
| "-" | |
10521097
| " " | |
@@ -1069,36 +1114,45 @@ The length modifiers are defined as:
10691114
| "z" | | size_t
10701115
|===
10711116

1117+
The .precision is defined as:
1118+
1119+
[cols="1,1,5",options="header"]
1120+
|===
1121+
| Value | Identifier | Description
1122+
| "0" | | Observed that this has no effect in "%.0s"
1123+
| "*" | | An additional integer argument supplies the field width or precision.
1124+
|===
1125+
10721126
The types are defined as:
10731127

10741128
[cols="1,1,5",options="header"]
10751129
|===
10761130
| Value | Identifier | Description
10771131
| "@" | | Obj-C/CF/Swift object
1078-
| "a" | |
1079-
| "A" | |
1132+
| "a" | | Floating-point value
1133+
| "A" | | Floating-point value
10801134
| "c" | | Character value
1081-
| "C" | | Equivalent to "lc"
1135+
| "C" | | wide character value, equivalent to "lc"
10821136
| "d" | | Signed decimal integer value
1083-
| "D" | |
1084-
| "e" | |
1085-
| "E" | |
1086-
| "f" | |
1087-
| "F" | |
1088-
| "g" | |
1089-
| "G" | |
1090-
| "i" | |
1137+
| "D" | | Long signed decimal integer value, equivalent to "ld"
1138+
| "e" | | Floating-point value
1139+
| "E" | | Floating-point value
1140+
| "f" | | Floating-point value
1141+
| "F" | | Floating-point value
1142+
| "g" | | Floating-point value
1143+
| "G" | | Floating-point value
1144+
| "i" | | Signed decimal integer value
10911145
| "n" | |
1092-
| "o" | |
1093-
| "O" | |
1094-
| "p" | | Pointer value
1146+
| "o" | | Octal integer value
1147+
| "O" | | Long octal integer value, equivalent to "lo"
1148+
| "p" | | Pointer value, equivalent to "0x%x"
10951149
| "P" | | Binary data
10961150
| "s" | | String value
1097-
| "S" | | Equivalent to "ls"
1151+
| "S" | | Wide character string value, equivalent to "ls"
10981152
| "u" | | Unsigned decimal integer value
1099-
| "U" | |
1100-
| "x" | | Lower case hexadecimal interger value
1101-
| "X" | | Upper case hexadecimal interger value
1153+
| "U" | | Long unsigned decimal integer value, equivalent to "lu"
1154+
| "x" | | Hexadecimal interger value, formatter in lower case
1155+
| "X" | | Hexadecimal interger value, formatter in upper case
11021156
|===
11031157

11041158
=== Oversize chunk
@@ -1439,6 +1493,98 @@ The UUID text (uuidtext) entry descriptor is 8 bytes of size and consists of:
14391493
Contains an UTF-8 formatted string with an end-of-string character
14401494
|===
14411495

1496+
== Value type decoders
1497+
1498+
=== [[core_location_client_manager_state_tracker_state]]Core location client manager (CLClientManager) state tracker state
1499+
1500+
[cols="1,1,1,5",options="header"]
1501+
|===
1502+
| Offset | Size | Value | Description
1503+
| 0 | 4 | | Location enabled status
1504+
| 4 | 4 | | Location restricted +
1505+
Contains a boolean value where false if 0 or true otherwise
1506+
|===
1507+
1508+
[yellow-background]*TODO confirm location enabled status is the first value in the
1509+
structure. Only seen data where both values are 0.*
1510+
1511+
The value is formatted as:
1512+
1513+
....
1514+
{"locationRestricted":false,"locationServicesEnabledStatus":0}
1515+
....
1516+
1517+
=== [[core_location_location_manager_state_tracker_state]]Core location location manager (CLLocationManager) state tracker state
1518+
1519+
[cols="1,1,1,5",options="header"]
1520+
|===
1521+
| Offset | Size | Value | Description
1522+
| 0 | 8 | | Distance filter +
1523+
Contains a floating-point value
1524+
| 8 | 8 | | Desired accuracy +
1525+
Contains a floating-point value
1526+
| 16 | 1 | | Updating location +
1527+
Contains a boolean value where false if 0 or true otherwise
1528+
| 17 | 1 | | Requestiong location +
1529+
Contains a boolean value where false if 0 or true otherwise
1530+
| 18 | 1 | | Requestiong ranging +
1531+
Contains a boolean value where false if 0 or true otherwise
1532+
| 19 | 1 | | Updating ranging +
1533+
Contains a boolean value where false if 0 or true otherwise
1534+
| 20 | 1 | | Updating heading +
1535+
Contains a boolean value where false if 0 or true otherwise
1536+
| 21 | 3 | | [yellow-background]*Unknown*
1537+
| 24 | 8 | | Heading filter +
1538+
Contains a floating-point value
1539+
| 32 | 1 | | Allows location prompts +
1540+
Contains a boolean value where false if 0 or true otherwise
1541+
| 33 | 1 | | Allows altered accessory location +
1542+
Contains a boolean value where false if 0 or true otherwise
1543+
| 34 | 1 | | Dynamic accuracy reduction enabled +
1544+
Contains a boolean value where false if 0 or true otherwise
1545+
| 35 | 1 | | Previous authorization status valid +
1546+
Contains a boolean value where false if 0 or true otherwise
1547+
| 36 | 4 | | Previous authorization status
1548+
| 40 | 1 | | Limits precision +
1549+
Contains a boolean value where false if 0 or true otherwise
1550+
| 41 | 7 | | [yellow-background]*Unknown*
1551+
| 48 | 8 | | Activity type +
1552+
Contains a signed integer
1553+
| 56 | 4 | | Pauses location updates automatically +
1554+
Contains a signed integer
1555+
| 60 | 1 | | Paused +
1556+
Contains a boolean value where false if 0 or true otherwise
1557+
| 61 | 1 | | Allows background location +
1558+
Contains a boolean value where false if 0 or true otherwise
1559+
| 62 | 1 | | Shows background location +
1560+
Contains a boolean value where false if 0 or true otherwise
1561+
| 63 | 1 | | Allows map correction +
1562+
Contains a boolean value where false if 0 or true otherwise
1563+
4+| _Additional values if size > 64_
1564+
| 64 | 1 | | Batching location +
1565+
Contains a boolean value where false if 0 or true otherwise
1566+
| 65 | 1 | | Updating vehicle speed +
1567+
Contains a boolean value where false if 0 or true otherwise
1568+
| 66 | 1 | | Updating vehicle heading +
1569+
Contains a boolean value where false if 0 or true otherwise
1570+
| 67 | 1 | | Match information enabled +
1571+
Contains a boolean value where false if 0 or true otherwise
1572+
| 68 | 1 | | Ground altitude enabled +
1573+
Contains a boolean value where false if 0 or true otherwise
1574+
| 69 | 1 | | Fusion information enabled +
1575+
Contains a boolean value where false if 0 or true otherwise
1576+
| 70 | 1 | | Courtesy prompt needed +
1577+
Contains a boolean value where false if 0 or true otherwise
1578+
| 71 | 1 | | Is authorized for widget updates +
1579+
Contains a boolean value where false if 0 or true otherwise
1580+
|===
1581+
1582+
The value is formatted as:
1583+
1584+
....
1585+
{"previousAuthorizationStatusValid":false,"paused":false,"requestingLocation":false,"updatingVehicleSpeed:false,"desiredAccuracy":100,"allowsBackgroundLocationUpdates":false,"dynamicAccuracyReductionEnabled":false,"distancFilter":-1,"allowsLocationPrompts":true,"activityType":0,"groundAltitudeEnabled":false,"pausesLocationUpdatesAutomatially":1,"fusionInfoEnabled":false,"isAuthorizedForWidgetUpdates":false,"updatingVehicleHeading":false,"batchingLocation":false,"showsBackgroundLocationIndicator":false,"updatingLocation":false,"requestingRanging":false,"updatingHeading:false,"previousAuthorizationStatus":0,"allowsMapCorrection":true,"matchInfoEnabled":false,"allowsAlteredAccessoryLoctions":false,"updatingRanging":false,"limitsPrecision":false,"courtesyPromptNeeded":false,"headingFilter":1}
1586+
....
1587+
14421588
== Notes
14431589

14441590
....

0 commit comments

Comments
 (0)