Detections
Analytics

5.1.1.2 Ensure journald service is enabled

Information

Ensure that the systemd-journald service is enabled to allow capturing of logging events.

If the systemd-journald service is not enabled to start on boot, the system will not capture logging events.

Solution

By default the systemd-journald service does not have an [Install] section and thus cannot be enabled / disabled. It is meant to be referenced as Requires or Wants by other unit files. As such, if the status of systemd-journald is not static, investigate why.

See Also

https://workbench.cisecurity.org/benchmarks/13007

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, CSCv7|6.2, CSCv7|6.3

Plugin: Unix

Control ID: b17b5248840481a2bfa6c5d5802502e6482e096161d6568dbfc3977e23a6104e