OpenControls Logo

STIG Viewer

STIGViewer Support

The macOS system must configure audit retention to seven days.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-277074APPL-26-001029SV-277074r1148674_ruleCCI-001849low
Description
The audit service must be configured to require that records be kept for an organizational-defined value before deletion unless the system uses a central audit record storage facility. When "expire-after" is set to "7d", the audit service will not delete audit logs until the log data criteria is met.
STIGDate
Apple macOS 26 (Tahoe) Security Technical Implementation Guide2026-05-23

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-04Event Log Storage Capacity
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (14) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AU-12Audit Record Generation
1.00
AU-14(1)System Start-up
1.00
AU-3Content of Audit Records
1.00
AU-3(1)Additional Audit Information
1.00
AU-4Audit Log Storage Capacity
1.00
AU-4(1)Transfer to Alternate Storage
1.00
AU-5Response to Audit Logging Process Failures
1.00
AU-5(1)Storage Capacity Warning
1.00
AU-5(2)Real-time Alerts
1.00
AU-7Audit Record Reduction and Report Generation
1.00

+4 more (top 10 by confidence shown)

CCI1 mapping
CCI-001849
1.00

Details

Check Text (C-277074r1148674_chk)

Verify the macOS system is configured to set audit retention to seven days with the following command: /usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control If the result is not "7d", this is a finding.

Fix Text (F-81134r1148673_fix)

Configure the macOS system to set audit retention to seven days with the following command: /usr/bin/sed -i.bak 's/^expire-after.*/expire-after:7d/' /etc/security/audit_control; /usr/sbin/audit -s