Detections
Analytics

5.1.2.1.1 Ensure systemd-journal-remote is installed

Information

Journald (via systemd-journal-remote ) supports the ability to send log events it gathers to a remote log host or to receive messages from remote hosts, thus enabling centralized log management.

Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.

Solution

Run the following command to install system-journal-gateway :

# yum install system-journal-gateway

See Also

https://workbench.cisecurity.org/benchmarks/15964

Item Details

Category: AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, 800-53|SI-5, CSCv7|6.2, CSCv7|6.3

Plugin: Unix

Control ID: 4511e81eab0c93c16de11a38083c7e8502c1c1c677608135ba342be80d4c49d3