Where Does Santa Store Rules on Mac?
Santa keeps binary allow and block rules in a local database, with event logs stored under /var/db/santa.
Last updated
Santa stores binary allow and block rules in a local database on the Mac. Executions check CDHash, binary, signing and team rules in precedence order. Logs record every decision under the santa data directory.
Manage rules with santactl for one machine or a sync server for fleets. Config profiles set mode and server URLs. The database holds the past too, since unknown binaries stay recorded for later review.
Where Santa stores this, by platform
/var/db/santa (rules database plus santa.log)
Allow and block rules in local database, managed by santactl or sync server. Logs and spool under santa data dir. Config via profile com.google.santa.
Frequently asked questions
How do I migrate Santa rules?
Use santactl rule commands to list and export the local rules, then apply them on the new machine. Sync servers push the same rules centrally for fleets. Logs do not need to move.
Where do I watch what Santa blocks?
Tail the santa.log file to see every execution decision. Rules live in the database, events stream there too. Unified Logging holds extra health details for the system extension.
Notice an outdated path? Let us know.