BSD syscall#359
svc · unix #359
auditctl
Opens or rotates the kernel audit trail file used by auditd.
Prototype
int auditctl(char *path);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| path | char | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 359 |
| xnu-1699.24.8 | macOS 10.7 Lion | 359 |
| xnu-2050.18.24 | macOS 10.8 Mountain Lion | 359 |
| xnu-2422.115.4 | macOS 10.9 Mavericks | 359 |
| xnu-2782.40.9 | macOS 10.10 Yosemite | 359 |
| xnu-3247.1.106 | macOS 10.11 El Capitan | 359 |
| xnu-3789.1.32 | macOS 10.12 Sierra | 359 |
| xnu-4570.1.46 | macOS 10.13 High Sierra | 359 |
| xnu-4903.221.2 | macOS 10.14 Mojave | 359 |
| xnu-6153.11.26 | macOS 10.15 Catalina | 359 |
| xnu-7195.50.7.100.1 | macOS 11.0 Big Sur | 359 |
| xnu-8019.41.5 | macOS 12.0 Monterey | 359 |
| xnu-8792.41.9 | macOS 13.0 Ventura | 359 |
| xnu-10002.1.13 | macOS 14.0 Sonoma | 359 |
| xnu-11215.1.10 | macOS 15.0 Sequoia | 359 |
| xnu-11417.101.15 | macOS 15.4 Sequoia | 359 |
| xnu-12377.1.9 | macOS 26.0 Tahoe | 359 |
| xnu-10002.41.9 | — | 359 |
| xnu-10002.61.3 | — | 359 |
| xnu-10002.81.5 | — | 359 |
| xnu-10063.101.15 | — | 359 |
| xnu-10063.121.3 | — | 359 |
| xnu-10063.141.1 | — | 359 |
| xnu-11215.41.3 | — | 359 |
| xnu-11215.61.5 | — | 359 |
| xnu-11215.81.4 | — | 359 |
| xnu-11417.121.6 | — | 359 |
| xnu-11417.140.69 | — | 359 |
| xnu-12377.101.15 | — | 359 |
| xnu-12377.41.6 | — | 359 |
| xnu-12377.61.12 | — | 359 |
| xnu-12377.81.4 | — | 359 |
| xnu-1486.2.11 | — | 359 |
| xnu-1504.15.3 | — | 359 |
| xnu-1504.3.12 | — | 359 |
| xnu-1504.7.4 | — | 359 |
| xnu-1504.9.17 | — | 359 |
| xnu-1504.9.26 | — | 359 |
| xnu-1504.9.37 | — | 359 |
| xnu-1699.22.73 | — | 359 |
| xnu-1699.22.81 | — | 359 |
| xnu-1699.24.23 | — | 359 |
| xnu-1699.26.8 | — | 359 |
| xnu-1699.32.7 | — | 359 |
| xnu-2050.22.13 | — | 359 |
| xnu-2050.24.15 | — | 359 |
| xnu-2050.48.11 | — | 359 |
| xnu-2050.7.9 | — | 359 |
| xnu-2050.9.2 | — | 359 |
| xnu-2422.1.72 | — | 359 |
| xnu-2422.100.13 | — | 359 |
| xnu-2422.110.17 | — | 359 |
| xnu-2422.90.20 | — | 359 |
| xnu-2782.1.97 | — | 359 |
| xnu-2782.10.72 | — | 359 |
| xnu-2782.20.48 | — | 359 |
| xnu-2782.30.5 | — | 359 |
| xnu-3247.10.11 | — | 359 |
| xnu-3248.20.55 | — | 359 |
| xnu-3248.30.4 | — | 359 |
| xnu-3248.40.184 | — | 359 |
| xnu-3248.50.21 | — | 359 |
| xnu-3248.60.10 | — | 359 |
| xnu-3789.21.4 | — | 359 |
| xnu-3789.31.2 | — | 359 |
| xnu-3789.41.3 | — | 359 |
| xnu-3789.51.2 | — | 359 |
| xnu-3789.60.24 | — | 359 |
| xnu-3789.70.16 | — | 359 |
| xnu-4570.20.62 | — | 359 |
| xnu-4570.31.3 | — | 359 |
| xnu-4570.41.2 | — | 359 |
| xnu-4570.51.1 | — | 359 |
| xnu-4570.61.1 | — | 359 |
| xnu-4570.71.2 | — | 359 |
| xnu-4903.231.4 | — | 359 |
| xnu-4903.241.1 | — | 359 |
| xnu-4903.270.47 | — | 359 |
| xnu-6153.101.6 | — | 359 |
| xnu-6153.121.1 | — | 359 |
| xnu-6153.141.1 | — | 359 |
| xnu-6153.41.3 | — | 359 |
| xnu-6153.61.1 | — | 359 |
| xnu-6153.81.5 | — | 359 |
| xnu-7195.101.1 | — | 359 |
| xnu-7195.121.3 | — | 359 |
| xnu-7195.141.2 | — | 359 |
| xnu-7195.60.75 | — | 359 |
| xnu-7195.81.3 | — | 359 |
| xnu-8019.61.5 | — | 359 |
| xnu-8019.80.24 | — | 359 |
| xnu-8020.101.4 | — | 359 |
| xnu-8020.121.3 | — | 359 |
| xnu-8020.140.41 | — | 359 |
| xnu-8792.61.2 | — | 359 |
| xnu-8792.81.2 | — | 359 |
| xnu-8796.101.5 | — | 359 |
| xnu-8796.121.2 | — | 359 |
| xnu-8796.141.3 | — | 359 |
Notes
auditctl(2) takes a path and tells the kernel to start writing BSM records to that file, closing whatever trail was previously active. Passing NULL or an empty path stops auditing entirely. It is the mechanism behind audit(8) -s / -n and is restricted by the audit_control privilege; on modern macOS it is only meaningful when auditd is running.
Detection
Generates AUE_AUDITCTL. Defenders should treat any auditctl(NULL) from a non-auditd process as a high-confidence anti-forensics signal, and watch for trail rotation to paths outside /var/audit/.
Related APIs
auditauditonsetauidendpoint_security