Apple deprecated its OpenBSM audit system beginning with macOS Big Sur, but the audit system itself stayed enabled until the release of macOS Sonoma. As of macOS Sonoma, it is now disabled and does not run by default. The man page includes this deprecation notice section:

If you still need to have the OpenBSM audit system running on macOS Sonoma, it’s possible to re-enable it using the procedure described in the man page. For more information, please see below the jump.

Check if it’s already running

Before enabling, I recommend verifying that it’s not already running. For example, I know that Jamf Pro 10.50 and later will re-enable the OpenBSM auditing system on macOS Sonoma Macs. Please use the procedure below to check and see if something else has already enabled the OpenBSM audit system.

1. Run the following command with root privileges:

If it’s already enabled and running, you should see output similar to what’s shown below:

If it’s not running you should see output similar to what’s shown below:

If the OpenBSM audit system is not running and you want to enable it, please use the procedure described below:

1. Run the following command with root privileges:

2. Run the following command with root privileges:

3. Restart the Mac.

4. Following the restart, verify that the auditd service is enabled by running the following command with root privileges:

You should see output similar to what’s shown below:

Note: If you have a custom configuration for OpenBSM auditing, you’ll need to add those configuration settings to the following file:

/etc/security/audit_control

For more information on configuration of OpenBSM auditing, please see the audit_control man page or my earlier post on OpenBSM auditing.