Detections
Analytics

6.1.1.3 Ensure journald is configured to send logs to rsyslog

Information

Data from systemd-journald may be stored in volatile memory or persisted locally on the server. Utilities exist to accept remote export of systemd-journald logs, however, use of the rsyslog service provides a consistent means of log collection and export.

systemd-journald is always present and acts as the initial collector of system log events. Forwarding those events to rsyslog provides a single, consistent path for log processing and export, including reliable delivery to a centralized log server for retention and correlation. When forwarding is not enabled, events collected by journald are not passed to rsyslog for further processing.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Ensure ForwardToSyslog is set to yes and that no other entry overrides it.

 - Run the following command to locate every file that sets ForwardToSyslog :

# grep -PHrs -- '^\h*ForwardToSyslog\h*=' /etc/systemd/journald.conf /etc/systemd/journald.conf.d/

 -

In each file returned, remove or comment out the ForwardToSyslog line so the setting is defined in only one place.

 -

Set ForwardToSyslog=yes in a drop-in file in /etc/systemd/journald.conf.d/ ending in .conf.

Example:

# [ ! -d /etc/systemd/journald.conf.d ] && mkdir -p /etc/systemd/journald.conf.d
# printf '%s\n' "[Journal]" "ForwardToSyslog=yes" >> /etc/systemd/journald.conf.d/60-journald.conf

Run the following command to apply the change to the running service:

# systemctl reload-or-restart systemd-journald.service

Impact:

With forwarding enabled, events collected by systemd-journald are duplicated into rsyslog in addition to being retained by journald. Ensure rsyslog log storage and rotation are sized to accommodate the additional log volume this forwarding generates.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-6, 800-53|AU-6(3), 800-53|AU-7, 800-53|AU-12, CSCv7|6.2, CSCv7|6.3, CSCv7|6.5

Plugin: Unix

Control ID: af813f536cb9e15c2ee578b7a721d007ea864a17364c5032a99683d5acfae8ad