Run praudit on /dev/auditpipe to live decode the audit log.
sudo praudit /dev/auditpipe
live decode the audit log
macOS Support Resources and Information
macOS Support Resources and Information
Run praudit on /dev/auditpipe to live decode the audit log.
sudo praudit /dev/auditpipe