Basically, it sums up to this:
- Applications can use the syslog API (bsd_in) and the asl API (asl_in) to log messages by handing them over to the syslog daemon (syslogd). Other data that gets logged can come from the kernel (klog_in) or from the network (udp_in).
- All of these messages are handled by syslogd, which outputs log messages both the BSD way (bsd_out: it writes stuff into various basic log files like /var/log) and into a unified log message store (asl_action: the message store is in /var/log/asl/*).
- Console displays both kinds of logging facilities: "classical" log files and database searches. Even if you delete all .log files, the database is still intact and full of entries.
Also, if you want to troubleshoot, there should be no need to clear old log files, you will only have to be more specific over what you want to read from the log. A good starting point would be using "syslog" (not syslogd!) from the command line, where you can parse logs with more specific instructions (have a look at man syslog). So if you were to parse all messages logged by Safari in the last 5 hours you would run:
syslog -k Facility -k Time ge -5h -k Sender Safari
or to see all messages, but not those of Mail:
syslog -k Facility -k Sender ne Mail
Trust me, even though this might look confusing, it´s far better to read logs on the command line than in Console.app
But if you want to keep on using Console you still might want to checkout the man page for aslmanager and syslog.conf to see how you can eg. configure where the files are kept, for how long, and how to archive them.
tail -f /var/log/lognameto watch it... – peelman Feb 15 '11 at 17:59