1.\" Copyright (c) 2004 Apple Inc. 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 8.\" 1. Redistributions of source code must retain the above copyright 9.\" notice, this list of conditions and the following disclaimer. 10.\" 2. Redistributions in binary form must reproduce the above copyright 11.\" notice, this list of conditions and the following disclaimer in the 12.\" documentation and/or other materials provided with the distribution. 13.\" 3. Neither the name of Apple Inc. ("Apple") nor the names of 14.\" its contributors may be used to endorse or promote products derived 15.\" from this software without specific prior written permission. 16.\" 17.\" THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY 18.\" EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 19.\" WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 20.\" DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY 21.\" DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 22.\" (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 23.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 24.\" ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27.\" 28.Dd April 18, 2020 29.Dt AUDITD 8 30.Os 31.Sh NAME 32.Nm auditd 33.Nd audit log management daemon 34.Sh SYNOPSIS 35.Nm 36.Op Fl d | l 37.Sh DESCRIPTION 38The 39.Nm 40daemon responds to requests from the 41.Xr audit 8 42utility and notifications 43from the kernel. 44It manages the resulting audit log files and specified 45log file locations. 46.Pp 47The options are as follows: 48.Bl -tag -width indent 49.It Fl d 50Starts the daemon in debug mode \[em] it will not daemonize. 51.It Fl l 52This option is for when 53.Nm 54is configured to start on-demand using 55.Xr launchd 8 . 56.El 57.Pp 58Optionally, the audit review group "audit" may be created. 59Non-privileged 60users that are members of this group may read the audit trail log files. 61.Sh NOTE 62To assure uninterrupted audit support, the 63.Nm 64daemon should not be started and stopped manually. 65Instead, the 66.Xr audit 8 67command 68should be used to inform the daemon to change state/configuration after altering 69the 70.Pa audit_control 71file. 72.Pp 73If 74.Nm 75is started on-demand by 76.Xr launchd 8 77then auditing should only be started and stopped with 78.Xr audit 8 . 79.Pp 80On Mac OS X, 81.Nm 82uses the 83.Xr asl 3 84API for writing system log messages. 85Therefore, only the audit administrator 86and members of the audit review group will be able to read the 87system log entries. 88.Sh FILES 89.Bl -tag -width ".Pa /etc/security" -compact 90.It Pa /var/audit 91Default directory for storing audit log files. 92.Pp 93.It Pa /etc/security 94The directory containing the auditing configuration files 95.Xr audit_class 5 , 96.Xr audit_control 5 , 97.Xr audit_event 5 , 98and 99.Xr audit_warn 5 . 100.El 101.Sh COMPATIBILITY 102The historical 103.Fl h 104and 105.Fl s 106flags are now configured using 107.Xr audit_control 5 108policy flags 109.Cm ahlt 110and 111.Cm cnt , 112and are no longer available as arguments to 113.Nm . 114.Sh SEE ALSO 115.Xr asl 3 , 116.Xr audit 4 , 117.Xr audit_class 5 , 118.Xr audit_control 5 , 119.Xr audit_event 5 , 120.Xr audit_warn 5 , 121.Xr audit 8 , 122.Xr auditdistd 8 , 123.Xr launchd 8 (Mac OS X) 124.Sh HISTORY 125The OpenBSM implementation was created by McAfee Research, the security 126division of McAfee Inc., under contract to Apple Computer Inc.\& in 2004. 127It was subsequently adopted by the TrustedBSD Project as the foundation for 128the OpenBSM distribution. 129.Sh AUTHORS 130.An -nosplit 131This software was created by McAfee Research, the security research division 132of McAfee, Inc., under contract to Apple Computer Inc. 133Additional authors include 134.An Wayne Salamon , 135.An Robert Watson , 136and SPARTA Inc. 137.Pp 138The Basic Security Module (BSM) interface to audit records and audit event 139stream format were defined by Sun Microsystems. 140