Detections
Analytics

3.1.11 Ensure syslog messages are not suppressed

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

When logging to Syslog and syslog_sequence_numbers is on, then each message will be prefixed by an increasing sequence number (such as [2]).

Many modern Syslog implementations perform a log optimization and suppress repeated log entries while emitting " --- last message repeated N times --- ". In more modern Syslog implementations, repeated message suppression can be configured (for example, $RepeatedMsgReduction in rsyslog ).

Solution

Execute the following SQL statement(s) to remediate this setting:

postgres=# alter system set syslog_sequence_numbers = 'on';
ALTER SYSTEM
postgres=# select pg_reload_conf();
 pg_reload_conf
----------------
 t
(1 row)

Impact:

If disabled, messages sent to Syslog could be suppressed and not logged. While a message is emitted stating that a given message was repeated and suppressed, the timestamp associated with these suppressed messages is lost, potentially damaging the recreation of an incident timeline.

See Also

https://workbench.cisecurity.org/benchmarks/19478

Item Details

Plugin: PostgreSQLDB

Control ID: 4f60c23ec3d02d04f9539f1c49c6064e8c085cd70b9001debda39e79caa84616