Collecting Unified Logs for macOS

[mrtc0]

Since macOS 10.12 (Sierra) and later, macOS logs are saved as Unified Logs in binary format. Since these are not text-based logs, is it not possible for the Datadog Agent to collect them?
Also, is the only way to collect these logs to output them to a separate file using the log command and then collect them with the Datadog Agent?

[Japillow]

Note: The following documentation describes the equivalent functionality provided by Jamf Protect: https://learn.jamf.com/en-US/bundle/jamf-protect-documentation/page/Unified_Logging.html

[Japillow]

Another side note: the cost of Datadog agent usually means organizations may not deploy datadog agent on all MacOS workstations. Organisations are likely to want to use opensource collection methods. Datadog OSS Vector tool doesn't support collecting from MacOS Unified Logs either (https://vector.dev/docs/reference/configuration/sources/).

I opened a feature request in the Vector repo to track interest: vectordotdev/vector#23993