Re: [Fed-Talk] Retain audit logs
Re: [Fed-Talk] Retain audit logs
- Subject: Re: [Fed-Talk] Retain audit logs
- From: Todd Heberlein <email@hidden>
- Date: Fri, 06 May 2011 10:35:49 -0700
What do I need to do to be sure my OS X 10.6 systems retain their audit logs? Right now it seems they are automatically deleted after a period of time.
The file
/etc/security/audit_control
controls the auditing system, and the field "expire-after:" in that file controls when older log files are deleted. You can probably remove this line to prevent older audit files from being deleted. For more information, do
$ man audit_control
Todd
|
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Fed-talk mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden