Detections
Analytics

6.1.1.1.1 Ensure journald service is active

Information

Ensure that the systemd-journald service is enabled to allow capturing of logging events.

If the systemd-journald service is not enabled to start on boot, the system will not capture logging events.

Solution

Run the following commands to unmask, enable, and start systemd-journald.service

# systemctl unmask systemd-journald.service
# systemctl --now enable systemd-journald.service

Impact:

Restarting systemd-journald may briefly interrupt log collection.

See Also

https://workbench.cisecurity.org/benchmarks/27797

Item Details

Category: AUDIT AND ACCOUNTABILITY, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, 800-53|SC-24, CSCv7|6.2, CSCv7|6.3

Plugin: Unix

Control ID: 004e6bd9a6f511d2931b1f1eefd7deb131b50ceb0f6bebfe503efd9212c3e621