audit_retention_configure_sixty_days remediation not getting picked up by Jamf Protect insights #242

New Issue

michael · 2026-01-19T18:29:47Z

michael commented

2026-01-19 18:29:47 +00:00

Originally created by @ZaoDigital on GitHub.

fix: |
  [source,bash]
  ----
  /usr/bin/sed -i.bak 's/^expire-after.*/expire-after:60d or 1G/' /etc/security/audit_control; /usr/sbin/audit -s

Running Monterey 12.4:
The lowercase 'or' between 60d and 1G is causing Jamf Protect to not have compliance with the associated insight

Uppercasing the 'OR' will remediate it as expected

(I would submit a PR for the fix but the contribution guidelines suggest I should open in issues instead, yeah?)

Originally created by @ZaoDigital on GitHub. ``` fix: | [source,bash] ---- /usr/bin/sed -i.bak 's/^expire-after.*/expire-after:60d or 1G/' /etc/security/audit_control; /usr/sbin/audit -s ``` Running Monterey 12.4: The lowercase 'or' between 60d and 1G is causing Jamf Protect to not have compliance with the associated insight Uppercasing the 'OR' will remediate it as expected (I would submit a PR for the fix but the contribution guidelines suggest I should open in issues instead, yeah?)

michael closed this issue

2026-01-19 18:29:47 +00:00

michael commented

2026-01-19 18:29:47 +00:00

@robertgendler commented on GitHub:

Looks like from the man page it should be in capitals. So AND or OR. We'll update and fix things.

@robertgendler commented on GitHub: Looks like from the man page it should be in capitals. So AND or OR. We'll update and fix things.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#242