3.5 Retain install.log for 365 or more days

Information

Archiving and retaining install.log for at least a year is beneficial in the event of an incident as it will allow the user to view the various changes to the system along with the date and time they occurred.

Solution

Perform the following to implement the prescribed state:
Run the following command in Terminal:
sudo vim /etc/asl/com.apple.install
Replace or edit the current setting with a compliant setting
* file /var/log/install.log mode=0640 format=bsd rotate=utc compress file_max=5M ttl=365

See Also

https://workbench.cisecurity.org/files/301

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-11

Plugin: Unix

Control ID: bf55c695c6e6b7f01dc90845a2a04d512166c4c5239ceeeb2d600d938e2a7eca