/etc/security/  
└── audit_control
    └── Line 8
-        └── policy:cnt,argv            (Original)
+        └── policy:cnt,argv,arge       (Modified)

/Applications/
└── cmdReporter.app

/usr/local/bin/
└── cmdReporter (symlink)

/Library/LaunchDaemons/
└── com.cmdsec.cmdreporter.plist

/Library/LaunchAgents/
└── com.cmdsec.cmdreporterhelper.plist

/var/cmdreporter/        # Supporting files and offline log spool location
└── remoteEndpointLogger

/var/log/
└── cmdReporter.log

/etc/security/
├── audit_class
├── audit_control
├── audit_event
├── audit_user
└── audit_warn