The operating system must initiate session audits at system startup.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-67551	AOSX-11-000230	SV-82041r1_rule		Medium

Description
If auditing is enabled late in the startup process, the actions of some start-up processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created.

STIG	Date
Apple OS X 10.11 Security Technical Implementation Guide	2018-01-04

Details

Check Text ( C-68117r1_chk )
To check if the audit service is running, use the following command: /usr/bin/sudo /bin/launchctl list | /usr/bin/grep com.apple.auditd If nothing is returned, the audit service is not running, this is a finding.

Fix Text (F-73665r1_fix)
To enable the audit service, run the following command: /usr/bin/sudo /bin/launchctl load -w /System/Library/LaunchDaemons/com.apple.auditd.plist