Detections
Analytics

6.2.2.10 Ensure rsyslog is configured to log cron events

Information

Cron logging must be implemented.

Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used to spot intrusions into the use of the cron facility by unauthorized and malicious users.

Solution

Configure "rsyslog" to log all cron messages by adding or updating the following line to "/etc/rsyslog.conf" or a configuration file in the /etc/rsyslog.d/ directory:

cron.* /var/log/cron

The rsyslog daemon must be restarted for the changes to take effect:

# systemctl restart rsyslog.service

See Also

https://workbench.cisecurity.org/benchmarks/19886

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CSCv7|6.3, Rule-ID|SV-230387r743996_rule, Vuln-ID|V-230387

Plugin: Unix

Control ID: 5e07b42345ab321c6300e5afff9405e7781a2925e12f67737d844ba21590cf43