Detections
Analytics

5.1.2.3 Ensure journald is configured to send logs to rsyslog

Information

Data from journald may be stored in volatile memory or persisted locally on the server. Utilities exist to accept remote export of journald logs, however, use of the RSyslog service provides a consistent means of log collection and export.

IF RSyslog is the preferred method for capturing logs, all logs of the system should be sent to it for further processing.

Solution

Edit the /etc/systemd/journald.conf file and add the following line:

ForwardToSyslog=yes

Restart the service:

# systemctl restart rsyslog

See Also

https://workbench.cisecurity.org/benchmarks/13007

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-6(3), 800-53|AU-7, 800-53|AU-9, 800-53|AU-12, CSCv7|6.2, CSCv7|6.3, CSCv7|6.5

Plugin: Unix

Control ID: 0251c61844805d9cec998c272450d1f222b9dc52b6ceae91abf18b0f8b4b7154