Detections
Analytics

1.136 APPL-26-004050

Information

The macOS system must configure install.log retention to 365.

GROUP ID: V-277163
RULE ID: SV-277163r1148941

The install.log must be configured to require that records be kept for an organizational-defined value before deletion, unless the system uses a central audit record storage facility.

Proper audit storage capacity is crucial to ensuring the ongoing logging of critical events.

Solution

Configure the macOS system with install.log retention to 365 with the following command:

/usr/bin/sed -i '' "s/\* file \/var\/log\/install.log.*/\* file \/var\/log\/install.log format='\$\(\(Time\)\(JZ\)\) \$Host \$\(Sender\)\[\$\(PID\\)\]: \$Message' rotate=utc compress file_max=50M size_only ttl=365/g" /etc/asl/com.apple.install

Note: If multiple configuration files in /etc/asl are set to process the file /var/log/install.log, these files must be manually removed.

See Also

https://workbench.cisecurity.org/benchmarks/26538

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4, CCI|CCI-001849, Rule-ID|SV-277163r1148941_rule, STIG-ID|APPL-26-004050, Vuln-ID|V-277163

Plugin: Unix

Control ID: 7a3213ba8142d236e6fa6a4c54f757ba21957f3c77f12adb41ba43e6cca8c847