Detections
Analytics

6.1.2.1 Ensure rsyslog is installed

Information

rsyslog is a reliable, feature-rich system logging service. The rsyslog package provides the rsyslogd daemon, which collects log messages from the kernel, system services, and applications (including those gathered by the systemd journal) and writes them to persistent on-disk log files under /var/log, and can filter, rate-limit, and forward them to a central log host.

Persistent, reliable logging is fundamental to security operations: it preserves the record of system and security events needed for accountability, threat detection, incident investigation, and forensic analysis. The systemd journal stores its logs in volatile memory by default, so without a persistent logging service those records can be lost across a reboot or under memory pressure. Installing rsyslog establishes durable on-disk log retention and the foundation for later centralization and protection of that log data.

Solution

Run the following command to install rsyslog :

# dnf install rsyslog

Impact:

None. rsyslog is installed and enabled by default on supported platforms; where the package must be installed, the operational impact is negligible.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, 800-53|CM-6b., CSCv7|6.2, CSCv7|6.3

Plugin: Unix

Control ID: de3504142b732f9cb24e6fa726619b1318467fd1e276f6464b4b1949da7a5486