Detections
Analytics

1.137 APPL-14-004050

Information

The macOS system must configure install.log retention to 365.

GROUP ID: V-259558RULE ID: SV-259558r958752

The install.log must be configured to require records be kept for an organizational-defined value before deletion, unless the system uses a central audit record storage facility.

Solution

Configure the macOS system with install.log retention to 365 with the following command:

/usr/bin/sed -i '' "s/* file /var/log/install.log.*/* file /var/log/install.log format='$((Time)(JZ)) $Host $(Sender)[$(PID\)]: $Message' rotate=utc compress file_max=50M size_only ttl=365/g" /etc/asl/com.apple.install

Note: If there are multiple configuration files in /etc/asl that are set to process the file /var/log/install.log, these files will have to be manually removed.

See Also

https://workbench.cisecurity.org/benchmarks/24070

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4, CAT|III, CCI|CCI-001849, Rule-ID|SV-259558r958752_rule, STIG-ID|APPL-14-004050, Vuln-ID|V-259558

Plugin: Unix

Control ID: 99ec0334c0707a0aaa8ae98a56264fc974618312cf54618fa30290a0e71d4d01