Detections
Analytics

5.1.1.3 Ensure journald is configured to send logs to rsyslog

Information

Data from journald may be stored in volatile memory or persisted locally on the server. Utilities exist to accept remote export of journald logs, however, use of the RSyslog service provides a consistent means of log collection and export.

IF RSyslog is the preferred method for capturing logs, all logs of the system should be sent to it for further processing.

Note: This recommendation only applies if rsyslog is the chosen method for client side logging. Do not apply this recommendation if journald is used.

Solution

Edit the /etc/systemd/journald.conf file and add the following line:

ForwardToSyslog=yes

Restart the service:

# systemctl restart rsyslog

See Also

https://workbench.cisecurity.org/benchmarks/12705

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AC-3, 800-53|AU-2, 800-53|AU-4, 800-53|AU-6(3), 800-53|AU-7, 800-53|AU-12, 800-53|MP-2, 800-53|SI-5, CSCv7|6.2, CSCv7|6.3, CSCv7|6.5

Plugin: Unix

Control ID: 7feabe9f873bb76bc5dc78a5f1ac5e28d1e883200df9ef23a203b20e085281e8