Detections
Analytics

6.2.2.2 Ensure rsyslog service is enabled and active

Information

Once the rsyslog package is installed, ensure that the service is enabled.

If the rsyslog service is not enabled to start on boot, the system will not capture logging events.

Solution

- IF - rsyslog is being used for logging on the system:

Run the following commands to unmask, enable, and start rsyslog.service :

# systemctl unmask rsyslog.service
# systemctl enable rsyslog.service
# systemctl start rsyslog.service

See Also

https://workbench.cisecurity.org/benchmarks/23602

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-3, 800-53|AU-7, 800-53|AU-12, CSCv7|6.2, CSCv7|6.3

Plugin: Unix

Control ID: bc502f16ba9482c5d5a14e55c4d749e79e7ca978918aa2888b057c03280a31bc