Ensure install.log Is Retained for 365 or More Days and No Maximum Size

MoyenneNiveau 1Automatiséemacos

Description

macOS writes information pertaining to system-related events to the file /var/log/install.log and has a configurable retention policy for this file. The default logging setting limits the file size of the logs and the maximum size for all logs. The default allows for an errant application to fill the log files and does not enforce sufficient log retention. Audit: Requires ttl >= 365 and no all_max= setting in /etc/asl/com.apple.install.

Méthode de vérification

Méthode d'audit: Commande shell

shell

f=/etc/asl/com.apple.install
[ -r "$f" ] || exit 1
t=$(/usr/bin/grep -io 'ttl=[0-9]*' "$f" | /usr/bin/head -1 | /usr/bin/cut -d= -f2)
if [ -n "$t" ] && [ "$t" -ge 365 ] && ! /usr/bin/grep -qi 'all_max=' "$f"; then echo compliant; else echo "ttl=${t:-unset}; all_max present or ttl < 365"; fi

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Terminal: Edit the /etc/asl/com.apple.install file and add or modify the ttl value to 365 or greater on the file line. Also, remove the all_max= setting and value from the file line.

Propriétés

Systèmes d'exploitation: macos-26
Étiquettes: macoslogging-auditing
Référence: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 3.3 Ensure install.log Is Retained for 365 or More Days and No Maximum Size

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target macos