Debug Logging
NoMAD Login AD uses Apple's unified logging system for logging. By default we log some basic info, but you can turn the logging level up if you want to see a lot more blow by blow info.
When you are looking at the logs you can see what level the entries were made at, and which section of the NoLoAD code made the entries by way of the category.
For example, this log entry is a debug entry made by the CreateUser Mechanism. You can also see that the authorizationhost was the process that was running the NoLoAD code at the time:
2017-12-27 14:01:37.127349-0800 0x891e Debug 0x0 1720 authorizationhost: (NoMADLoginAD) [menu.nomad.noload:CreateUserMech] Account creation skipped, allowing login
To watch the login process happen, follow these steps:
- Login to the Mac you want to log on via SSH.
- Start the debug logging with
log stream --predicate 'subsystem == "menu.nomad.login.ad"' --debug - Login with the user you want to see logs for.
- When you are satisfied, press control-c to quit the log program.
Since we are using the Apple logging system you can observe and gather logs in a few other ways as well.
The simplest is to use the Console app and fast user switching. If you take a look under the Action menu, you can enable debug log messages there. Now just Fast User Switch to the login window and test away.
You can also take a sysdiagnose to gather the logs for EVERYTHING that is currently going on. This can be handy for general system diagnosis. At any time you can press Control-Option-Command-Shift-Period to trigger the process. The logs will be found in /private/tmp and the Finder will open a window to reveal them once the gathering process is complete.
The log stream command has another parameter which can be used to pull logs after a login. This is useful when doing diagnostic work related to SecureTokens. The following command will pull the logs for the last 5 minutes. Though please keep in mind that debug logs do not appear to be persisted outside of a log stream.
log show --predicate 'subsystem == "menu.nomad.login.ad"' --last 5m
Login with AD User with account creation (Debug On):
Login with AD User with account creation (Debug Off):
Login with local account (Debug On):
AD User with failed authentication (Debug On):
Clicked sign in button with no user (Debug On):
