Graylog2 / Graylog2/graylog2-server

Remove 24h backfill default from macOS unified logger collector source

Open Beginner friendly
#27,195 0 comments 0 reactions 0 assignees View on GitHub
bug collector
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior
The default behavior should be to start at the end of the log stream, not 24h earlier, to be in line with what the other major sources support.
Specifically journald and Windows Event Logs cannot look back in time without processing individual logs, so it's weird if one source behaves differently.

## Current Behavior
The macOS unified logger source has a max-age of 24h as its default that should be 0 by default.

## Possible Solution
Simply change the default, but we need to see if that is enough.

## Steps to Reproduce (for bugs)
n/a this is to have everything behave the same.

## Your Environment

* Graylog Version: 7.2 beta.1
* Java Version:
* OpenSearch Version:
* MongoDB Version:
* Operating System:
* Browser version:

## Checklist
[] This issue fix need to be backported.
[] Does this issue have **security** implications?

Contributor guide

Open the contributing guide

Research direction

Locate the macOS unified logger collector source and find the default max-age setting. Compare its behavior with the journald and Windows Event Logs sources, change the default to 0, and run the relevant collector tests to confirm the stream starts at the end by default.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, macos
Domain
backend, observability-sre
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.