Detections
Analytics
APPL-26-004050 - The macOS system must configure install.log retention to 365.
Information
The install.log must be configured to require that records be kept for an organizational-defined value before deletion, unless the system uses a central audit record storage facility.Proper audit storage capacity is crucial to ensuring the ongoing logging of critical events.
Solution
Configure the macOS system with install.log retention to 365 with the following command:/usr/bin/sed -i '' "s/\* file \/var\/log\/install.log.*/\* file \/var\/log\/install.log format='\$\(\(Time\)\(JZ\)\) \$Host \$\(Sender\)\[\$\(PID\\)\]: \$Message' rotate=utc compress file_max=50M size_only ttl=365/g" /etc/asl/com.apple.install
Note: If multiple configuration files in /etc/asl are set to process the file /var/log/install.log, these files must be manually removed.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apple_macOS_26_V1R2_STIG.zip
Item Details
Audit Name: DISA Apple macOS 26 Tahoe STIG v1r2
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-4, CAT|III, CCI|CCI-001849, Rule-ID|SV-277163r1148941_rule, STIG-ID|APPL-26-004050, Vuln-ID|V-277163
Plugin: Unix
Control ID: 7101da17ca3d04ec7cc02b1d4bf77177b37801cf3e11a1422ddc892cfe3552d9