I am trying to process the logs collected from MacOX kernel using the method described on page 251 of the guide, using /usr/bin/log. I pretty much copied the entire code block, including xm_multiline and xm_json modules. The problem I am running into is that parse_json throws an error for a very specific message and I don't understand what it doesn't like about it. It ONLY complains about this event, while successfully processing others. First the error: 2019-02-06 11:47:19 ERROR failed to parse json string, parse error: invalid object key (must be a string); pple.duetactivityscheduler", }; (right here) ------^; [{; "category" : "scoring",; "processImageUUID" : "C8A8C46F-C86F-3DCE-AA7F-5128FEC80F95",; "processUniqueID" : 104,; "threadID" : 322877,; "timestamp" : "2019-02-06 11:47:19.133462-0500",; "traceID" : 1264507192737796,; "messageType" : "Default",; "senderProgramCounter" : 143258,; "processID" : 104,; "machTimestamp" : 10284775415304436,; "timezoneName" : "",; "subsystem" : "com.apple.duetactivityscheduler",;}]

Seems like it only complains about the events with subsystem of "com.apple.duetactivityscheduler.

I was able to view one of those events and nothing looks out of the ordinary for me:

{ "category" : "lifecycle", "processImageUUID" : "C8A8C46F-C86F-3DCE-AA7F-5128FEC80F95", "processUniqueID" : 104, "threadID" : 324554, "timestamp" : "2019-02-06 11:54:38.540442-0500", "traceID" : 1258391159308292, "messageType" : "Default", "senderProgramCounter" : 49785, "processID" : 104, "machTimestamp" : 10285214841060059, "timezoneName" : "", "subsystem" : "com.apple.duetactivityscheduler", "eventMessage" : "CANCELED: 0:com.apple.timed.ntp.needed:B67ADB <private>!", "senderImageUUID" : "B94808C8-E8F6-349C-9CCF-2C2C3EF30A24", "processImagePath" : "/usr/libexec/dasd", "senderImagePath" : "/System/Library/DuetActivityScheduler/Scheduler/DuetActivitySchedulerDaemon.bundle/Contents/MacOS/DuetActivitySchedulerDaemon" }