Ensure Security Auditing Logs Are Retained for 30 Days

MediumLevel 1Automatedmacos

Description

The macOS audit capability contains important information to investigate security or operational issues. This resource is only completely useful if it is retained long enough to allow technical staff to find the root cause of anomalies in the records. Retention can be set to respect both size and longevity. Audit: Requires a day-based expire-after value of at least 30d.

How it is checked

Audit method: Shell command

shell

l=$(/usr/bin/grep -e "^expire-after" /etc/security/audit_control 2>/dev/null) || exit 1
d=$(printf '%s' "$l" | /usr/bin/grep -oE '[0-9]+d' | /usr/bin/head -1 | /usr/bin/tr -d d)
if [ -n "$d" ] && [ "$d" -ge 30 ]; then echo compliant; else echo "$l"; fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Terminal: Edit the /etc/security/audit_control file so that expire-after: is at least 30d

Properties

Operating systems: macos-15
Tags: macoslogging-auditing
Reference: CIS Apple macOS 15.0 Sequoia Benchmark v2.1.0 - 3.4 Ensure Security Auditing Logs Are Retained for 30 Days

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target macos