Detections
Analytics

6.1.1.4 Ensure journald log file rotation is configured

Information

Journald includes the capability of rotating log files regularly to avoid filling up the system with logs or making the logs unmanageably large. Journal rotation is configured in /etc/systemd/journald.conf and in drop-in files under /etc/systemd/journald.conf.d/.

By keeping the log files smaller and more manageable, a system administrator can easily archive these files to another system and spend less time looking through inordinately large log files.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Set the journal rotation parameters in a drop-in file in /etc/systemd/journald.conf.d/ ending in .conf. Set the parameters in the [Journal] section, adjusting the values to site policy, and ensure no other file overrides them.

Example:

[Journal]
SystemMaxUse=1G
SystemKeepFree=500M
SystemMaxFileSize=100M
RuntimeMaxUse=200M
RuntimeKeepFree=50M
RuntimeMaxFileSize=50M
MaxFileSec=1month

Note: These parameters have specific edge cases and interactions; review journald.conf(5) for the exact semantics.

See Also

https://workbench.cisecurity.org/benchmarks/27893

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-4, 800-53|AU-7, 800-53|AU-12, CSCv7|6.4

Plugin: Unix

Control ID: 37cd1f14979858a2273a1a26238b2d216cf290e71a1b68b4efbc7d71ad740a91