Detections
Analytics
6.1.2.14 Ensure logrotate is configured
Information
logrotate manages the automatic rotation, compression, and removal of log files so they do not grow without bound. The log files produced by rsyslog are rotated according to /etc/logrotate.conf and the drop-in files under /etc/logrotate.d/ (for example /etc/logrotate.d/syslog).Without log rotation, log files grow without bound and can consume all available space on their filesystem, disrupting logging itself and other services that share that filesystem. Rotating and aging logs bounds disk use while retaining recent records for the period required by site policy.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Edit /etc/logrotate.conf (and any files under /etc/logrotate.d/ ) to rotate logs on a fixed schedule, retain a bounded number of rotations, compress old logs, and set a maximum age. Apply the following baseline in /etc/logrotate.conf :# rotate log files weekly
weekly
# keep 13 weeks of backlogs
rotate 13
# remove rotated logs older than 90 days
maxage 90
# compress rotated logs
compress
# create new (empty) log files after rotating old ones
create
Note: Tune the weekly, rotate, and maxage values to your organization's log-retention policy; the values above are a recommended starting point.
Impact:
Enforcing log rotation ages out and removes log files once they pass the configured retention window. If the rotation and retention settings are more aggressive than the organization's requirements, historical logs needed for investigation or compliance may be removed prematurely; retention should be set to satisfy the applicable log-retention policy.
See Also
Item Details
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-4, 800-53|AU-8, CSCv7|6.4
Plugin: Unix
Control ID: ca5aa78d4404bc584ec20add41806ba0843b4f563454d5e87bd50756af6a0578