Auditd fileset breaks the system module on macOS

[tsg]

The auditd fileset has no paths defined for macOS. Unfortunately, because all filesets are enabled by default, it means that the system module doesn't work on macOS.

This is the relevant portion of the manifest file:

var:
  - name: paths
    default:
      - /var/log/audit/audit.log*
    os.darwin: [""]
    os.windows: []

An easy solution would be to replace os.darwin: [] with os.darwin: [""], which would mean that the fileset is silently ignored on macOS, but I see that and auditd daemon does seem to exist on macOS as well.

@andrewkroh Would it make sense to support the macOS' auditd?

[andrewkroh]

I opened #3923 to address this.

It would make sense to have this work on macOS. But I don't know much about auditing on macOS, in fact I don't even know where the logs are (checked /var/log/audit but it does not exists for me). I thought they were written using Apple's Unified Logging framework meaning the logs are in binary somewhere, but I can't even find them in Console.