---
id: os_install_log_retention_configure
title: Configure Install.log Retention to $ODV
discussion: |
  The install.log _MUST_ be configured to require records be kept for a organizational defined value before deletion, unless the system uses a central audit record storage facility.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95211-9
      macos_15:
        - CCE-94212-8
      macos_14:
        - CCE-92811-9
    800-53r5:
      - AU-11
      - AU-4
    800-171r3:
      - 03.03.03
  disa:
    cci:
      - CCI-001849
    srg:
      - SRG-OS-000341-GPOS-00132
    disa_stig:
      macos_26:
        - APPL-26-004050
      macos_15:
        - APPL-15-004050
      macos_14:
        - APPL-14-004050
    cmmc:
      - AU.L2-3.3.1
  bzk:
    bio:
      - 8.19
      - 8.19.01
  cis:
    benchmark:
      macos_26:
        - 3.3 (level 1)
      macos_15:
        - 3.3 (level 1)
      macos_14:
        - 3.3 (level 1)
    controls_v8:
      - 8.1
      - 8.3
platforms:
  macOS:
    '27.0': {}
    '26.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: medium
        - name: nlmapgov_plus
    '15.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: medium
        - name: nlmapgov_plus
    enforcement_info:
      check:
        shell: /usr/sbin/aslmanager -dd 2>&1 | /usr/bin/awk '/\/var\/log\/install.log$/ {count++} /Processing module com.apple.install/,/Finished/ { for (i=1;i<=NR;i++) { if ($i == "TTL" && $(i+2) >= $ODV) { ttl="True" }; if ($i == "MAX") {max="True"}}} END{if (count > 1) { print "Multiple config files for /var/log/install, manually remove the extra files"} else if (max == "True") { print "all_max setting is configured, must be removed" } if (ttl != "True") { print "TTL not configured" } else { print "Yes" }}'
        result:
          string: 'Yes'
      fix:
        shell: '/usr/bin/sed -i '''' "s/\* file \/var\/log\/install.log.*/\* file \/var\/log\/install.log format=''\$\(\(Time\)\(JZ\)\) \$Host \$\(Sender\)\[\$\(PID\\)\]: \$Message'' rotate=utc compress file_max=50M size_only ttl=$ODV/g" /etc/asl/com.apple.install'
        additional_info: 'NOTE: If there are multiple configuration files in /etc/asl that are set to process the file /var/log/install.log, these files will have to be manually removed.'
odv:
  hint:
    datatype: number
    description: Number of days, e.g. 365
    validation:
      min: 1
  recommended: 365
  cis_lvl1: 365
  cis_lvl2: 365
  nlmapgov_plus: 365
  disa_stig: 365
tags:
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cnssi-1253_moderate
