STIGQter: STIG Summary: Apple macOS 15 (Sequoia) Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Apr 2026:

The macOS system must configure install.log retention to 365.

DISA Rule

SV-268554r1034602_rule

Vulnerability Number

V-268554

Group Title

SRG-OS-000341-GPOS-00132

Rule Version

APPL-15-004050

Severity

CAT III

CCI(s)

CCI-001849 - Allocate audit log storage capacity to accommodate organization-defined audit record retention requirements.

Weight

Fix Recommendation

Configure the macOS system with install.log retention to 365 with the following command:

/usr/bin/sed -i '' "s/\* file \/var\/log\/install.log.*/\* file \/var\/log\/install.log format='\$$\(Time$$JZ$\) \$Host \$$Sender$\[\$$PID\$\]: \$Message' rotate=utc compress file_max=50M size_only ttl=365/g" /etc/asl/com.apple.install

NOTE: If multiple configuration files in /etc/asl are set to process the file /var/log/install.log, these files must be manually removed.

Check Contents

Verify the macOS system is configured with install.log retention to 365 with the following command:

/usr/sbin/aslmanager -dd 2>&1 | /usr/bin/awk '/\/var\/log\/install.log$/ {count++} /Processing module com.apple.install/,/Finished/ { for (i=1;i<=NR;i++) { if ($i == "TTL" && $(i+2) >= 365) { ttl="True" }; if ($i == "MAX") {max="True"}}} END{if (count > 1) { print "Multiple config files for /var/log/install, manually remove the extra files"} else if (max == "True") { print "all_max setting is configured, must be removed" } if (ttl != "True") { print "TTL not configured" } else { print "Yes" }}'

If the result is not "yes", this is a finding.

Vulnerability Number

V-268554

Documentable

False

Rule Version

APPL-15-004050

Severity Override Guidance

Check Content Reference

Target Key

5661