/var/log/windowserver.log not showing up in Console utility

Discussion in 'Apple' started by Jeff Wiseman, Mar 21, 2005.

  1. Jeff Wiseman

    Jeff Wiseman Guest

    OS 10.3.6 on G5 iMac. When I run the Console utility, all of the
    /var/log/xxxx.log files show up except the windowserver.log.

    Is something broken here? How do I get this log to show up in
    Console?

    Because of the windowserver/fast login bug reported here a ways
    back, I've been interestedin watching the windowserver log. That
    is when I discovered that Console won't show it on my system.

    Anyone know why this is appears to be broken?
     
    Jeff Wiseman, Mar 21, 2005
    #1
    1. Advertisements

  2. Jeff Wiseman

    Tom Stiller Guest

    Works fine on my 10.3.8 system. What are the permissions on the
    windowserver.log file? Mine are:
    -rw-r----- 1 root wheel 84663 21 Mar 15:41 /var/log/windowserver.log
     
    Tom Stiller, Mar 21, 2005
    #2
    1. Advertisements

  3. Jeff Wiseman

    Jeff Wiseman Guest


    Exactly the same. I deleted the
    ~/Library/Preferences/com.apple.Console.plist file which contains
    the list of logs used byConsole. Logged out and back in then
    started up Console and again it rebuilt the .plist file excluding
    the windowserver.log file. I'm using 10.3.6 system.

    I also noticed that when logging into a standard user account,
    you get even less logs shown but that would be expected based on
    the lesser priviledges.

    I wonder if anyone using 10.3.6 or earlier can see the
    /var/log/Windowserver.log file in their console.
     
    Jeff Wiseman, Mar 22, 2005
    #3
  4. Jeff Wiseman

    Tom Stiller Guest

    The account I tested on was originally built way back when and updated
    through the archive and install process through several releases of Mac
    OS X. What happens if you add:
    <dict>
    <key>autoOpen</key>
    <string>YES</string>
    <key>path</key>
    <string>/var/log/windowserver.log</string>
    <key>stringEncoding</key>
    <integer>4</integer>
    </dict>
    and
    <key>NSWindow Frame /var/log/windowserver.log</key>
    <string>54 296 948 426 0 0 1024 746 </string>

    to ~/Library/Preferences/com.apple.Console.plist?

    I also have similar entries for "/var/log/windowserver_last.log"
     
    Tom Stiller, Mar 22, 2005
    #4
  5. Jeff Wiseman

    Jeff Wiseman Guest

    I added these to the .plist and Change the autoOpen to NO since
    the system log was already set to YES. Opened the console--no
    windwoserver.log. Closed Console and went back to look at .plist.
    Lo and behold, the new entry had been deleted! Put it back in
    exactly as your text including the autoOpen YES value. Started
    Console and got two Console windows (as expected), one with my
    system default and the other labled windowserver.log. However,
    the new second window for windowserver.log was empty and trying
    to update it got nothing. I closed the windows and shut down
    Console then looked at the .plist again. Once more the
    "offending" windowserver.log entries had been removed by the
    Consol application.

    Console just refuses to to have anything to do with that log.
    Again, I wonder if this is just a 10.3.6 thing. I've not yet
    convinced myself that it's time to upgrade yet.

    My About Console information shows version 2.0 (v48)

    Anyone out there with 10.3.6 that can confirm this behavior? Just
    open the Console Utility and look under the /var/log logs for the
    windowserver log.
     
    Jeff Wiseman, Mar 22, 2005
    #5
  6. Jeff Wiseman

    Tom Stiller Guest

    I can't imagine why you wouldn't go to 10.3.8, but i guess you have your
    reasons.
    Mine too.
     
    Tom Stiller, Mar 22, 2005
    #6
  7. Jeff Wiseman

    Jeff Wiseman Guest


    I've gotten burned too many times by jumping the gun. I like to
    give it a couple months and see what others have experienced
    until I have a warm fuzzy about the new version being stable in
    areas that I need. For example, I avoided the trouble in 10.3.7
    by waiting. Once I find a version that's good and solid, I tend
    to stay with it until I need something specific that it doesn't
    give me.

    That being said, 10.3.8 so far seems have fairly good reports so
    far so I will likely be converting in the not so distant future.
    I've not completed my backup plan for my system (It's fairly new)
    and I wanted to get that in place also prior to upgrading.


    I don't have a clue what is going on then. Have you tried
    accessing the Console from a standard account?
     
    Jeff Wiseman, Mar 22, 2005
    #7
  8. Jeff Wiseman

    Tom Stiller Guest

    With the release of Tiger within the next three months, the gun will
    have gone off with you still in the starting blocks :)
    Restricted list of available log files; windowserver.log is not among
    them. I have to admit, it never occurred to me to try from a non-admin
    account.
     
    Tom Stiller, Mar 22, 2005
    #8
  9. Jeff Wiseman

    Jeff Wiseman Guest


    Well, that is as it should be. I do get a further restricted list
    in a standard account as well.

    In fact, I see it now as quite obvious. Technically, only Root
    and Wheel have access to the log (Access mode of 640 with the
    owner root and the group of wheel). I checked this out by running
    "sudo chmod 644" on the log file itself. When I run Console, it
    comes up just fine showing the log file, the way it should. Now
    I'm wondering two things:

    1) Why is the access on this log file limited to root/wheel only?
    The /var/log directory files are all owned by root but they are
    split with some being wheel group and others being admin. For log
    files, you'd think that they would all be admin group for
    maintenance. Also, some of the most important (e.g., secure.log)
    actually have admin group (although it has no group access)! I
    suspect that someone hasn't decided upon how the ownership of
    those logs is supposed to work relative the the conext of Mac
    maintenance.

    2) Why is it that you can access that log? I presume that you are
    not running as superuser, so that would imply that your account
    belongs to the wheel group. You can confirm this by opening a
    terminal window and just typing in "groups". On my system, my
    default admin account only belongs to the appserverusr, admin,
    and appserveradm groups. Does your admin account also belong to
    the wheel group? If it is, that may be a management issue added
    sometime after 10.3.6.
     
    Jeff Wiseman, Mar 23, 2005
    #9
  10. Jeff Wiseman

    Jeff Wiseman Guest

    Hi Dave,

    Thanks for the input. I'm assuming that you are NOT using 10.3.8
    but rather 10.3.6 like myself?

    Also I'm assuming that the windowserver.log file ownerships are
    the same as ours (i.e., root/wheel). Is that correct?

    Since you can't see the file either, I'm also assuming that if
    you run the "groups" command in a terminal window from your admin
    account, it will show that you are not in the wheel group.
     
    Jeff Wiseman, Mar 23, 2005
    #10
  11. Jeff Wiseman

    Tom Stiller Guest


    It does indeed; although I can't recall if i added the group manually of
    if it was part of a many versions ago installation of mac OS X and
    carried forward by the archive and install process of upgrading.

    FWIW my UID is a member of groups "staff wheel admin therapy". I _know_
    group "therapy" was added by myself :)
     
    Tom Stiller, Mar 23, 2005
    #11
  12. Jeff Wiseman

    Jeff Wiseman Guest


    Interesting. So Console is behaving exactly as it should. The
    issue is that I suspect Apple changes the "meaning" of various
    groups some as they learn the best way to make these assignements
    and as you upgrade from release to release, it is unlikely that
    your account group assignments will be removed (simply because
    the issues are so complex).

    For example. Why is your admin account NOT assigned to the
    appserverusr and appserveradm groups? In 10.3.6 those are part of
    the default assignment for a new admin account--at least that is
    how it was set up for me the first time I ran my system and
    logged in. This would imply that I have normal access to some
    file systems that your admin priviledges do not.

    I think that Apple hasn't figured all of the security kinks
    needed for the system yet as far as owner/group/access file
    attributes go.
     
    Jeff Wiseman, Mar 23, 2005
    #12
  13. Jeff Wiseman

    Tom Stiller Guest

    I think you're right. I just checked my administrator groups on my
    wife's iBook (which shipped with panther) and they are "tms appserverusr
    admin appserveradm" -- "tms" being the short username on that machine.
    I know about the change to a separate group for each user, but I missed
    the addition of groups "appserverusr" and "appserveradm".
     
    Tom Stiller, Mar 23, 2005
    #13
  14. Jeff Wiseman

    Jeff Wiseman Guest


    As it turns out, it appears that the exact same version of
    Console is used in both the 10.3.6 and 10.3.8 releases. The
    differences appear to be the group assignments of the admin user
    which MIGHT have something to do with releases.


    Everyone I've heard from so far indicate the same thing. Console
    appears to be functioning the way it should properly respecting
    the file access priviledges


    This confirms my above statement. You aren't root and you are not
    in the Wheel group and the "Others" permissions on the log does
    not have read access so technically you aren't supposed to see
    the log anyway.

    Just curious, what groups does your admin user belong to? Tom
    Stiller's set (on a parallel stream in this thread) included
    Wheel but he may have added it. I'm confused though because his
    admin does NOT belong to appserverusr and appserveradm which my
    admin does. These are system default settings that appear may be
    different from release to release.

    In other words, if you started out with, say, OS 10.2.1 and
    upgraded to 10.3.8, your admin user group assignments are likely
    what the defaults were in 10.2.1 and not in 10.3.8 (if, in fact
    the defaults have changed).

    It would be nice to know since due to the very custom nature of
    group assignment, Apple is unlikely to change your account
    assignments during an upgrade, even though they have changed
    their own defaults to support some new security concept.
     
    Jeff Wiseman, Mar 23, 2005
    #14
  15. Jeff Wiseman

    Jeff Wiseman Guest


    So if I'm correct, you must have started with a pre 10.3.6 OS and
    upgraded to OS 10.3.8? That would explain the missing
    appserverusr and appserveradm since they weren't in the original
    OS's access priviledges concept. Your iBook's originally
    installed OS was probably newer and already had those groups in
    its concept.

    This is a bit nuts. Those are the types of things where warnings
    should be issued against the new upgrades and documented in the
    upgrade installer notes. If these were new groups, they could
    even have simply added them to all of the existing admin accounts
    and the account default templates for the system.

    A change was made that wasn't documented for the upgrade user.
    Loose ends again.
     
    Jeff Wiseman, Mar 23, 2005
    #15
  16. Jeff Wiseman

    Jeff Wiseman Guest


    That appears to be the same starting point that Tom Stiller had
    (see my other posting in this thread).

    Since your upgrade to Panther didn't seem to add those two new
    groups used by admins in Panther (i.e., appserveruser and
    appserveradm), technically my admin account can do things in
    Panther that your's cannot. Exactly what those groups are for, I
    don't know, but Apple's installers or install documentation
    didn't tell you about them.

    And yet they are important enough on new systems that all Admins
    are assigned to them.

    Thanks for the input, you've help confirm that pre-Panther OSs
    probably didn't use (or define) those groups and that the Panther
    updates aren't checking to see if the admin user's are being
    correctly assigned to them.
     
    Jeff Wiseman, Mar 23, 2005
    #16
  17. Jeff Wiseman

    Tom Stiller Guest

    Correct. I started with 10.1 and have retained the user and network
    setup through all updates of Jaguar and Panther to the current 10.3.8.
    The wife's iBook shipped with 10.3.3 and other than making sure that the
    same user had the same UID on all machines, I didn't mess with group
    memberships.

    I don't think I'd be too hard on Apple since messing with group
    assignments after a user has been running for a while can get very
    messy. I will probably migrate to the newer convention after I upgrade
    to Tiger, since there may be additional considerations.
     
    Tom Stiller, Mar 23, 2005
    #17
  18. Jeff Wiseman

    Tom Stiller Guest

    I just searched my many times updated iMac and the original 10.3 iBook
    for files belong to either of the groups "appserverusr" or
    "appserveradm" and found none on either machine. Maybe you can turn up
    some using:
    sudo find / -group appserverusr -or -group appserveradm.
     
    Tom Stiller, Mar 23, 2005
    #18
  19. Jeff Wiseman

    Tom Stiller Guest

    I wouldn't be concerned about /dev/fd/3, 4, od 5. They are readonly
    directories that are built at startup.
     
    Tom Stiller, Mar 23, 2005
    #19
  20. Jeff Wiseman

    Drew D. Saur Guest

    I am the original poster of the windowserver/FUS issue, and I too
    noticed this, on 10.3.8. I didn't fret because I tend to use the
    terminal to view logs anyway, but it is an odd thing, I admit. I figured
    that windowserver.log was just not a log that the console app was
    configured to read; sounds like some people can, but I am not sure why.

    Drew
     
    Drew D. Saur, Mar 24, 2005
    #20
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.