Enable Audit Logging on a Remote Mac Host
If a reviewer asks who signed in to your rented Mac last Tuesday and what the session touched, the answer must have been written before the question. On current macOS that record lives in two places with very different trust properties: the Unified Log (documented in Apple's Logging overview) and, for supported process, file and signal events, an entitled Endpoint Security client or a compatible endpoint security product. This guide is about getting the first one off the host correctly, and being honest about what the second one would add.
Pick a Figment Mac that matches your collection plan
Figment's current $29/month virtual Intel Mac (2 vCPU, 8 GiB RAM, 80 GiB disk, browser-console access) is the cheapest way to run the Unified Log workflow below. The pilot image runs macOS 15.8.3 (Sequoia); confirm the exact point release in your configuration quote before you commit a retention policy. The VM is not Apple silicon, so ARM-only agents will not execute on it; pick an M-series plan (from $95/month, chip, RAM and disk confirmed in the quote) if your SIEM shipper or an Endpoint Security extension requires arm64. Managed Build Mac ($249/month, one M-series Mac, CI setup, backups, monitoring and 30 minutes of monthly support) is a reasonable home for a scheduled collection job, but there is no standard SIEM integration bundled with that tier — the included CI setup covers build pipelines, not an arbitrary logging stack, so describe your receiver in the quote.
Access to the $29 VM is through the browser console. There is no public SSH. Anything the collection script produces must either be read back through the console or pushed outbound from the guest to a receiver you already run.
Export security events from the Unified Log
The Unified Log is not a complete audit of every login, process execution or file write — it is a structured stream of messages that Apple components and third-party code emit through os_log. Authorization and policy events show up because the relevant daemons log them, not because the kernel traces every syscall. Treat it as high-value context, not as ground truth for execution or filesystem change.
Start by sanity-checking the version and the subsystems emitting on your host:
sw_vers -productVersion
sudo log stats
For a one-off export covering the last day of authentication, authorization and screen-sharing activity, write to a user-owned private directory with a restrictive umask:
umask 077
mkdir -p "$HOME/audit"
chmod 700 "$HOME/audit"
EXPORT_DIR="$(mktemp -d "$HOME/audit/export.XXXXXX")"
sudo log show \
--last 24h \
--info \
--style ndjson \
--predicate 'subsystem == "com.apple.securityd" OR subsystem == "com.apple.authorization" OR subsystem == "com.apple.screensharing" OR subsystem == "com.apple.loginwindow"' \
> "$EXPORT_DIR/mac-security.ndjson"
The reader uses sudo; the shell writes the file as your own user into the new private directory. The predicate selects example subsystems, not a complete security-event inventory. Confirm which subsystems and processes emit the event you need on your exact macOS version. --info includes informational messages that may still be retained. Missing or redacted events cannot be reconstructed by this export. Repeating a rolling 24-hour export produces overlap; use fixed time windows or deduplicate when scheduling.
For a bounded archive that you can hand to an investigator unchanged, use log collect. It writes a .logarchive bundle that Console and log show --archive can open on another Mac:
sudo log collect \
--last 24h \
--output "$HOME/audit/mac-$(date -u +%Y%m%dT%H%M%SZ).logarchive"
The archive preserves the collected log structure. It is not proof of complete coverage or a cryptographically signed chain of custody. Record its collection window and transfer checksum, retain the original bundle, and follow your review process. Private-tagged fields in Apple log messages are still redacted in the archive unless the host has an Apple Configuration Profile that enables private-data logging — assume the default and do not promise your SIEM will see hostnames, URLs or usernames that Apple marked <private>. Flags and subcommands change between macOS versions, so verify man log on the exact point release you are running before you script a job around them.
Coverage worksheet: what the Unified Log misses
Before you ship anything, map your compliance control to what this pipeline actually captures.
| Event you need | Unified Log coverage | What actually records it |
|---|---|---|
| Interactive and remote-desktop login success/failure | Partial — com.apple.loginwindow, com.apple.securityd, lines from authd | Pair with last, /var/log/wtmp where present, or an SSO/agent that logs server-side |
sudo and policy authorization | Partial — verify the observed authorization events on this OS | Same, plus sudo lines when a sudoers-logging policy is in place |
| Every process exec with argv | No — only what a daemon chose to log | Endpoint Security (ES_EVENT_TYPE_NOTIFY_EXEC) in a signed system extension |
| Every file write to a path | No | Endpoint Security file events, or an EDR agent that uses the same framework |
| Outbound network connection with 5-tuple | No | A compatible Network Extension content filter or network monitoring product with the required event fields |
| Screen-sharing session start/stop | Partial — verify the actual session events | Same |
Apple's Endpoint Security framework provides supported process and file events to an entitled client. It requires the com.apple.developer.endpoint-security.client entitlement and applicable macOS permissions. A production system extension also has signing, notarization and installation requirements. It does not supply a universal record of network connections. Choose an existing compatible product or scope a separate implementation. Test event coverage, dropped-event handling and delivery before you rely on it for a control.
The classic BSM auditd subsystem is still referenced by the macOS audit(4) man page and can be started on older releases, but the exact command flags, launchd label and defaults have varied between macOS versions, and the setup you find in FreeBSD documentation is not safe to paste into a macOS host unchecked. If you specifically need BSM for a legacy control, verify man audit, man auditd and man audit_control on the actual macOS version you are renting, test the start and rotate commands against a throwaway trail, and keep that work as a separate project from the Unified Log pipeline above.
Hand the archive to your SIEM agent
Shipping is where homemade pipelines usually break. Three rules keep this collection useful without inventing infrastructure:
- Let your existing agent move the bytes. Use a supported macOS log-forwarding agent that can read the exported format. Confirm its collector configuration, authenticated TLS, retry behavior and delivery receipts. An endpoint security product does not necessarily ingest arbitrary local files or
.logarchivebundles. A one-lineloggerorcurlcall does none of that, and plaintext syslog over the public internet is not an acceptable transport for authorization events. - Set retention before you collect. Choose a retention period and disk cap with the reviewer. Delete an expired export only after its receipt and retention hold are checked. Treat a
.logarchiveas one bundle; deleting its individual files can damage it. Record this policy beside the collection job. Moving files out of the audit directory to "avoid resending" silently defeats retention; let the agent track its own offset instead. - Schedule it where the host can see it. A scheduled job cannot answer an interactive sudo prompt. Use your existing management agent or an administrator-configured service with the needed privileges; keep scripts and configuration protected from untrusted edits. A user LaunchAgent runs only in its user session. Keep non-secret configuration in version control and test missed runs, failures and disk limits.
Decision worksheet (fill this in and keep it with the plist)
- macOS version on the host (from
sw_vers -productVersion): __________ - Receiver — SIEM agent name and destination index or stream: __________
- On-host retention (days) and total cap (GB): __________
- SIEM retention (days): __________
- Subsystems in the predicate: __________
- Controls covered by the Unified Log alone: __________
- Controls that require Endpoint Security or another agent: __________
If line 7 is non-empty, schedule the extra work before you tell the control owner this host is covered. If line 3's cap times your event rate undercuts line 4, raise the on-host cap or shrink the predicate; do not quietly let the oldest events fall off the floor.
For a Mac that matches the plan on lines 1 through 3, start a configuration request and specify the macOS version, disk size and the outbound endpoint your agent needs to reach. Both the $29 VM and the M-series Figment Mac hosting plans are valid homes for this pipeline; which one you pick depends on whether an ARM-only agent or an Endpoint Security extension sits in your path. Ask for a configuration quote before you commit the control.
