- Audit Control
- The audit control log returns data related to the computer being audited, such as information pertaining to the host and also to the owner or group for identity signing.
- Log Level
- 1
- Requires Verbose Setting
- No
AUE_AUDITCTL Example
This is an example of a telemetry log for an audit control event.
{
"attributes": [
{
"device": 0,
"owner_group_name": "wheel",
"owner_user_id": 0,
"owner_user_name": "root",
"file_system_id": 16777232,
"file_access_mode": 33056,
"node_id": 9482899,
"owner_group_id": 0
}
],
"header": {
"time_seconds_epoch": 1657732936,
"time_milliseconds_offset": 959,
"version": 11,
"event_modifier": 0,
"event_id": 43042,
"event_name": "AUE_AUDITCTL"
},
"host_info": {
"serial_number": "C03WG0H4HDTS",
"host_name": "Test_MacBook_Pro",
"osversion": "Version 12.4 (Build 21F79)",
"host_uuid": "8891C1E2-0AC0-4E4A-844B-EA491B14D115"
},
"identity": {
"signer_id": "com.apple.auditd",
"team_id_truncated": false,
"signer_id_truncated": false,
"cd_hash": "3a8fc657d0760ad058d523e8b14eab0d2be5b29a",
"team_id": "",
"signer_type": 1
},
"key": "CFE7FE5A-C8A7-47A4-87EE-16A63295C8E7",
"path": [
"/var/audit/20220713172216.not_terminated",
"/private/var/audit/20220713172216.not_terminated"
],
"return": {
"error": 0,
"description": "success",
"return_value": 0
},
"subject": {
"responsible_process_id": 44229,
"process_name": "/usr/sbin/auditd",
"terminal_id": {
"type": 4,
"ip_address": "0.0.0.0",
"port": 0
},
"effective_group_id": 0,
"user_id": 0,
"process_id": 44229,
"effective_group_name": "wheel",
"effective_user_name": "root",
"user_name": "root",
"group_id": 0,
"group_name": "wheel",
"audit_id": 0,
"audit_user_name": "root",
"process_hash": "7e31f090cb89980640db07beeaa36fc5bb4886e6",
"effective_user_id": 0,
"session_id": 100245,
"responsible_process_name": "/usr/sbin/auditd"
}
}