Detections
Analytics
6.1.2.8 Ensure rsyslog logging rules are configured
Information
The /etc/rsyslog.conf file and the drop-in files ending in .conf under /etc/rsyslog.d/ specify rsyslog's logging rules - which classes of messages (by facility and severity) are recorded and which files they are written to.Security-relevant events - such as authentication successes and failures, privilege escalation, and root activity - are recorded through rsyslog. If logging rules are not configured to capture and retain these events, the records needed for accountability, detection, and investigation may never be written.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
- Edit the following lines in the /etc/rsyslog.conf and /etc/rsyslog.d/*.conf files as appropriate for your environment.Note: The below configuration is shown for example purposes only. Due care should be given to how the organization wishes to store log data.
*.emerg :omusrmsg:*
auth,authpriv.* /var/log/secure
mail.* -/var/log/mail
mail.info -/var/log/mail.info
mail.warning -/var/log/mail.warn
mail.err /var/log/mail.err
cron.* /var/log/cron
*.=warning;*.=err -/var/log/warn
*.crit /var/log/warn
*.*;mail.none;news.none -/var/log/messages
local0,local1.* -/var/log/localmessages
local2,local3.* -/var/log/localmessages
local4,local5.* -/var/log/localmessages
local6,local7.* -/var/log/localmessages
- Run the following command to restart rsyslog :
# systemctl restart rsyslog
See Also
Item Details
Audit Name: CIS AlmaLinux OS 9 v3.0.0 L1 Server
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, CSCv7|6.2, CSCv7|6.3
Plugin: Unix
Control ID: b0836d8d3c647735bf75868db6c51c3178c085ea71a4061bc980acddf16e19d6