Detections
Analytics

1.206 OL08-00-030010

Information

Cron logging must be implemented in OL 8.

GROUP ID: V-248723
RULE ID: SV-248723r991589

Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used to spot intrusions into the use of the cron facility by unauthorized and malicious users.

Solution

Configure "rsyslog" to log all cron messages by adding or updating the following line to "/etc/rsyslog.conf" or a configuration file in the "/etc/rsyslog.d/" directory:

cron.* /var/log/cron

The rsyslog daemon must be restarted for the changes to take effect:

$ sudo systemctl restart rsyslog.service

See Also

https://workbench.cisecurity.org/benchmarks/23791

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-248723r991589_rule, STIG-ID|OL08-00-030010, Vuln-ID|V-248723

Plugin: Unix

Control ID: a798855c720605494e4703484ddb5a5003faab24e05ebe2efe340ef94b3dda44