# dtFabric format specification.
---
name: asl
type: format
description: Apple System Log (ASL) file format
urls: ["https://github.com/libyal/dtformats/blob/main/documentation/Apple%20System%20Log%20(ASL)%20file%20format.asciidoc"]
---
name: byte
type: integer
attributes:
  format: unsigned
  size: 1
  units: bytes
---
name: uint16
type: integer
attributes:
  format: unsigned
  size: 2
  units: bytes
---
name: int32
type: integer
attributes:
  format: signed
  size: 4
  units: bytes
---
name: uint32
type: integer
attributes:
  format: unsigned
  size: 4
  units: bytes
---
name: uint64
type: integer
attributes:
  format: unsigned
  size: 8
  units: bytes
---
name: asl_file_header
type: structure
attributes:
  byte_order: big-endian
members:
- name: signature
  type: stream
  element_data_type: byte
  elements_data_size: 12
  value: "ASL DB\x00\x00\x00\x00\x00\x00"
- name: format_version
  data_type: uint32
- name: first_log_entry_offset
  data_type: uint64
- name: creation_time
  data_type: uint64
- name: cache_size
  data_type: uint32
- name: last_log_entry_offset
  data_type: uint64
- name: unknown1
  type: stream
  element_data_type: byte
  elements_data_size: 36
---
name: asl_record_string
type: structure
attributes:
  byte_order: big-endian
members:
- name: unknown1
  data_type: uint16
- name: string_size
  data_type: uint32
- name: string
  type: string
  encoding: utf8
  element_data_type: byte
  elements_data_size: asl_record_string.string_size
---
name: asl_record
type: structure
attributes:
  byte_order: big-endian
members:
- name: unknown1
  data_type: uint16
- name: data_size
  data_type: uint32
- name: next_record_offset
  data_type: uint64
- name: message_identifier
  data_type: uint64
- name: written_time
  data_type: uint64
- name: written_time_nanoseconds
  data_type: uint32
- name: alert_level
  data_type: uint16
- name: flags
  data_type: uint16
- name: process_identifier
  data_type: uint32
- name: user_identifier
  data_type: int32
- name: group_identifier
  data_type: int32
- name: read_user_identifier
  data_type: int32
- name: read_group_identifier
  data_type: int32
- name: reference_process_identifier
  data_type: uint64
- name: hostname_string_offset
  data_type: uint64
- name: sender_string_offset
  data_type: uint64
- name: facility_string_offset
  data_type: uint64
- name: message_string_offset
  data_type: uint64
---
name: asl_record_extra_field
type: structure
attributes:
  byte_order: big-endian
members:
- name: name_string_offset
  data_type: uint64
- name: value_string_offset
  data_type: uint64
---
name: asl_record_footer
type: structure
attributes:
  byte_order: big-endian
members:
- name: previous_record_offset
  data_type: uint64
