Flag to disable Logging

[the123blackjack]

What are the options available to disable logging completely. Considering i have already whitelisted what is required. There is no point to write to disk or even syslog it just to monitor the executions which i already know about.

I dont see how i can disable the logging completely in EventLogType or EventLogPath keys in config

Is there a workaround to achieve this

[russellhancox]

There is not currently an option to disable logging completely. However, logging to syslog requires a negligible amount of resources and the OS's logging system will throw away messages pretty quickly, especially if you aren't watching for them, so I would suggest setting the option to log to syslog if you're not interested in them.

[the123blackjack]

Thanks @russellhancox So i wont be filling up the disk or killing the writes of SSD by directing it to Syslog / Apple Unified Logging System?

More than compute what i was worried on is the Disk space filling up and Disk writes on the SSD for an info that i am not bothered about.

Hope you could bring in this option in the future as enhancement

[russellhancox]

The logging system is smart enough to not fill things up on disk unnecessarily, you should be fine. I'll keep this open as an enhancement request to add, it should be pretty simple

[arubdesu]

I don't currently ship these logs, but I would consider them valuable if you want to tap into the stream of executions to understand usage of e.g. installed apps - just because you're allowing them doesn't necessarily mean you are unconcerned if they ever get launched/'activated'(take focus)/or quit, userland daemons can miss things that launch with login and anything system-wide hidden from NSWorkspace.