macOS / binaries /

auditd

/usr/sbin/auditd
Audit log management daemon

The auditd daemon responds to requests from the audit utility and notifications from the kernel. It manages the resulting audit log files and specified log file locations.

source: man