Detections
Analytics
6.1.1.1 Ensure journald service is active
Information
systemd-journald is the systemd journaling service that collects and stores system log data. It is a static, socket-activated unit that is always present as the initial collector of log events on a systemd-based system; it is started by systemd rather than enabled to start on boot.systemd-journald must be running for the system to capture log events. If the service is not active, log events are not collected, removing the local record needed to detect, investigate, and respond to security-relevant activity.
Solution
Run the following commands to unmask and start systemd-journald.service:# systemctl unmask systemd-journald.service
# systemctl start systemd-journald.service
See Also
Item Details
Audit Name: CIS Red Hat Enterprise Linux 9 v3.0.0 L1 Server
Category: AUDIT AND ACCOUNTABILITY, SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, 800-53|SC-24, CSCv7|6.2, CSCv7|6.3
Plugin: Unix
Control ID: 70a90fdea882dfc108d05625821198877e9b004229082bdca9e9515580cae408