sysctl add kern.witnesswatch