Detections
Analytics

6.1.2.9 Ensure rsyslog is configured to send logs to a remote log host

Information

rsyslog can forward the log events it collects to a remote log host over the network (for example, with an omfwd action), sending a copy of local log data to a central collector for centralized log management.

Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

- Edit the /etc/rsyslog.conf and /etc/rsyslog.d/*.conf files and add a forwarding action (where loghost.example.com is the name of your central log host; the target directive may be a fully qualified domain name or an IP address):

*.* action(type="omfwd" target="loghost.example.com" port="514" protocol="tcp"
 action.resumeRetryCount="100"
 queue.type="LinkedList" queue.size="1000")

 - Run the following command to restart rsyslog :

# systemctl restart rsyslog

Impact:

Forwarding introduces a dependency on the remote collector and the network path to it; it does not replace local logging. Forwarded log volume consumes network bandwidth and collector storage, which should be sized accordingly.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-6, 800-53|AU-7, 800-53|AU-12, CSCv7|6.2, CSCv7|6.3

Plugin: Unix

Control ID: 415b3b9249c7a5a793e1729dd2be5a6501fc38e465ffa30e7a8872657cc73a31