Security auditing must be enabled.

From MAC OSX 10.6 Workstation Security Technical Implementation Guide

Part of OSX00140-Enable security auditing

Associated with IA controls: ECAR-3, ECAR-2, ECAR-1

SV-38520r1_rule Security auditing must be enabled.

Vulnerability discussion

Auditing is the capture and maintenance of information about security-related events. Auditing helps determine the causes and the methods used for successful and failed access attempts.

Check content

Open a terminal session and run the following command. sudo launchctl list Verify "com.apple.auditd" appears. If the file does not appear, this is a finding.

Fix text

Open a terminal session and run the following command. sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.auditd.plist

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.