Detections
Analytics

6.1.2.2 Ensure rsyslog service is enabled and active

Information

Once the rsyslog package is installed, ensure that the service is enabled.

If the rsyslog service is not enabled to start on boot, the system will not capture logging events.

Solution

- IF - rsyslog is being used for logging on the system:

Run the following commands to unmask, enable, and start rsyslog.service :

# systemctl unmask rsyslog.service
# systemctl enable rsyslog.service
# systemctl start rsyslog.service

See Also

https://workbench.cisecurity.org/benchmarks/24932

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CCI|CCI-000366, CSCv7|6.2, CSCv7|6.3, Rule-ID|SV-230298r1017108_rule, Rule-ID|SV-248615r991589_rule, Rule-ID|SV-260588r991562_rule, Rule-ID|SV-269518r1050401_rule

Plugin: Unix

Control ID: c8f422325ccf0a3ee4c411917e09972b4c284e44ea3c81ddfbffb6b3074ad119