Archiving and retaining install.log for at least a year is beneficial in the event of an incident as it will allow the user to view the various changes to the system along with the date and time they occurred. Without log files system maintenance and security forensics cannot be properly performed. Fix: Perform the following to ensure that install logs are retained for at least 365 days: Edit the /etc/asl/com.apple.install file and add or modify the ttl value to 365 or greater on the file line. Also, remove the all_max= setting and value from the file line.

[365 days]

Perform the following to ensure that install logs are retained for at least 365 days: Edit the /etc/asl/com.apple.install file and add or modify the ttl value to 365 or greater on the file line. Also, remove the all_max= setting and value from the file line.