If no preferences have been configured cmdReporter will run with the following parameters.
Preference file location: /Library/Preferences/com.cmdsec.cmdreporter.plist
| Key | Value Type | Default Value |
|---|---|---|
| AuditEventExcludedProcesses | Array of Strings | "/usr/sbin/mDNSResponder", "/usr/sbin/syslogd" |
| AuditLevel | Integer | 1 |
| TokenWatcherEnabled | Bool | false |
| LogFileMaxNumberBackups | Integer | 10 |
| LogFileMaxSizeMegaBytes | Integer | 10 |
| LogFileLocation | String | /var/log/cmdReporter.log |
| LogFilePermission | Integer | 640 |
| LogFileOwnership | String | root:wheel |
| FileEventUseFuzzyMatch | Bool | false |
| AuditEventLogVerboseMessages | Bool | false |