Local logging must be enabled.

From MAC OSX 10.6 Workstation Security Technical Implementation Guide

Associated with IA controls: ECAR-3, ECAR-2, ECAR-1

SV-38522r1_rule Local logging must be enabled.

Vulnerability discussion

Logging is essential for tracking system events, in the event of unauthorized access, logs may contain information about how and when the access occurred. Ensure logging is enabled and log files are properly rotated. The default configuration in /etc/newsyslog.conf is used to configure local logging in the /var/log folder. The computer is set to rotate log files using the periodic launchd job according to time intervals specified in the /etc/newsyslog.conf file.

Check content

Open a terminal session and enter the following command. more /etc/newsyslog.conf If the count values are not set to "14", this is a finding.

Fix text

Open a terminal session and edit the following file and set the count value(s) to "14". /etc/newsyslog.conf

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.