Detections
Analytics

5.1.2.5 Ensure journald is not configured to send logs to rsyslog

Information

Data from journald should be kept in the confines of the service and not forwarded on to other services.

IF journald is the method for capturing logs, all logs of the system should be handled by journald and not forwarded to other logging mechanisms.

Note: This recommendation only applies if journald is the chosen method for client side logging. Do not apply this recommendation if rsyslog is used.

Solution

Edit the /etc/systemd/journald.conf file and ensure that ForwardToSyslog=yes is removed.

Restart the service:

# systemctl restart systemd-journald.service

See Also

https://workbench.cisecurity.org/benchmarks/12705

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-6, 800-53|AU-6(3), 800-53|AU-7, 800-53|AU-12, CSCv7|6.2, CSCv7|6.3, CSCv7|6.5

Plugin: Unix

Control ID: cf9833ae62abbfe978207242ff1452e227ad90123a1ab6af36bea7005c6a3887