---
id: audit_retention_configure
title: Configure Audit Retention to $ODV
discussion: |
  The audit service _MUST_ be configured to require records be kept for a organizational defined value before deletion, unless the system uses a central audit record storage facility.

  When "expire-after" is set to "$ODV", the audit service will not delete audit logs until the log data criteria is met.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95130-1
      macos_15:
        - CCE-94130-2
      macos_14:
        - CCE-92730-1
    800-53r5:
      - AU-11
      - AU-4
    800-171r3:
      - 03.03.03
  disa:
    cci:
      - CCI-001849
    srg:
      - SRG-OS-000341-GPOS-00132
    disa_stig:
      macos_26:
        - APPL-26-001029
      macos_15:
        - APPL-15-001029
      macos_14:
        - APPL-14-001029
    cmmc:
      - AU.L2-3.3.1
  bzk:
    bio:
      - 8.18
      - 8.18.02
  cis:
    benchmark:
      macos_26:
        - 3.4 (level 1)
      macos_15:
        - 3.4 (level 1)
      macos_14:
        - 3.4 (level 1)
    controls_v8:
      - 8.1
      - 8.3
platforms:
  macOS:
    '27.0': {}
    '26.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: low
        - name: nlmapgov_plus
        - name: nlmapgov_base
    '15.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: low
        - name: nlmapgov_plus
        - name: nlmapgov_base
    enforcement_info:
      check:
        shell: '/usr/bin/awk -F: ''/expire-after/{print $2}'' /etc/security/audit_control'
        result:
          string: $ODV
      fix:
        shell: /usr/bin/sed -i.bak 's/^expire-after.*/expire-after:$ODV/' /etc/security/audit_control; /usr/sbin/audit -s
odv:
  hint:
    datatype: string
    description: Time or disk size, e.g. 60d OR 5G, see the man page for audit_control
    validation:
      regex: ^\d+[shdyBKMG](\s(AND|OR)\s\d+[shdyBKMG])?$
  recommended: 7d
  cis_lvl1: 60d OR 5G
  cis_lvl2: 60d OR 5G
  nlmapgov_base: 180d
  nlmapgov_plus: 180d
  disa_stig: 7d
tags:
  - 800-171
  - 800-53r5_privacy
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cnssi-1253_moderate
