dvt_oslog what is the source of the instability?

[dspiegelman]

I'm curious as to the source of the instability of dvt_oslog. I only ask because I need this feature desperately. I'm most interested in being able to see the logs from a single pid for about an hour at a time without interruption. The other logs generated by the system are of no interest to me. Ideally this would work as easily and reliably as adb currently does. It looks super promising though. This is the closest I've been able to get to viewing realtime application logs in iOS. Thank you!

[doronz88]

The dvt oslog is a much more complex data stream in which we need to decompress Apple's propietary logging stream compression and format the log lines ourselves. This is opposed to pymobiledevice3 syslog live which streams the fully formatted log lines (which is also the most used command for this stuff). Usually the stuff to break around is the string-formatting. If you do ding out the error - feel free to submit a PR :)

[dspiegelman]

Thank you for the quick response. I will try pymobiledevice3 syslog live first and that doesn't do what I need I will look into fixing the parsing bug. Can you kindly send me a permalink to where the parser lives?

[doronz88]

I would first wrap this whole code with try except because click "swallowes" the EOFError exception which usually occur while parsing.

pymobiledevice3/pymobiledevice3/cli/developer.py

Lines 634 to 664 in 1c6445a

	with DvtSecureSocketProxyService(lockdown=service_provider) as dvt:
	with ActivityTraceTap(dvt) as tap:
	for message in tap:
	message_pid = message.process
	# without message_type maybe signpost have event_type
	message_type = message.message_type if hasattr(message, 'message_type') else message.event_type \
	if hasattr(message, 'event_type') else 'unknown'
	sender_image_path = message.sender_image_path
	image_name = os.path.basename(sender_image_path)
	subsystem = message.subsystem
	category = message.category
	timestamp = datetime.now()
	if pid is not None and message_pid != pid:
	continue
	if message.message:
	formatted_message = decode_message_format(message.message)
	else:
	formatted_message = message.name
	if user_requested_colored_output():
	timestamp = click.style(str(timestamp), bold=True)
	message_pid = click.style(str(message_pid), 'magenta')
	subsystem = click.style(subsystem, 'green')
	category = click.style(category, 'green')
	image_name = click.style(image_name, 'yellow')
	message_type = click.style(message_type, 'cyan')
	print(f'[{timestamp}][{subsystem}][{category}][{message_pid}][{image_name}] '
	f'<{message_type}>: {formatted_message}')

As for the actual parsing, this is where I decode the format string:

pymobiledevice3/pymobiledevice3/services/dvt/instruments/activity_trace_tap.py

Lines 41 to 74 in 1c6445a

	def decode_message_format(message) -> str:
	s = ''
	for type_, data in message:
	if data and isinstance(data, bytes):
	data = ignored_null(data)
	type_ = decode_str(type_)
	if type_ == 'address':
	type_ = 'uint64-hex'
	if type_ in ('narrative-text', 'string'):
	if data is None:
	s += '<None>'
	else:
	s += data.decode()
	elif type_ == 'private':
	s += '<private>'
	elif type_.startswith('uint64'):
	uint64 = struct.unpack('<Q', data.ljust(8, b'\x00'))[0]
	if 'hex' in type_:
	uint64 = hex(uint64)[2:]
	if 'lowercase' in type_:
	uint64 = uint64.lower()
	s += str(uint64)
	elif 'decimal' in type_:
	uint64 = struct.unpack('<Q', data.ljust(8, b'\x00'))[0]
	s += str(uint64)
	elif type_ in ('data', 'uuid'):
	if data is not None:
	s += b''.join(data).hex()
	else:
	# by default, make sure the data can be concatenated
	s += str(data)
	return s

But this whole module is for parsing the whole data stream.

[doronz88]

Also, can I ask what kind of data you need that is available via dvt oslog only?

[dspiegelman]

Thank you for the code references. That gives me some ideas to try.

As for your question regarding my use case. I'm doing UI automation using appium/xcuitest. The app is logging state transitions via OSLog that I need to be able to catch in close to realtime. If you know of a better/different way to do this, I'm certainly all ears.

[doronz88]

Nothing should beat this service when it comes to realtime. Also it's the only official way to sniff signposts events.