Detections
Analytics

6.1.1.1.5 Ensure journald log file rotation is configured

Information

Journald includes the capability of rotating log files regularly to avoid filling up the system with logs or making the logs unmanageably large. The file /etc/systemd/journald.conf is the configuration file used to specify how logs generated by Journald should be rotated.

By keeping the log files smaller and more manageable, a system administrator can easily archive these files to another system and spend less time looking through inordinately large log files.

Solution

Edit /etc/systemd/journald.conf or a file ending in .conf the /etc/systemd/journald.conf.d/ directory. Set the following parameters in the [Journal] section to ensure logs are rotated according to site policy. The settings should be carefully understood as there are specific edge cases and prioritization of parameters.

Example Configuration

[Journal]
SystemMaxUse=1G
SystemKeepFree=500M
RuntimeMaxUse=200M
RuntimeKeepFree=50M
MaxFileSec=1month

Note: If these settings appear in a canonically later file, or later in the same file, the setting will be overwritten

Run the following command to apply the configuration change:

# systemctl reload-or-restart systemd-journald

Impact:

Log rotation limits may cause older entries to be dropped sooner; review the configured thresholds against local retention requirements before applying.

See Also

https://workbench.cisecurity.org/benchmarks/27797

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, CSCv7|6.2, CSCv7|6.3

Plugin: Unix

Control ID: ae3e62229759f3af7879f547dd2ef22138721becc81ad89d1efba2f1b9c9f0d0