Detections
Analytics

6.1.2.2 Ensure rsyslog service is enabled and active

Information

The rsyslog service (rsyslogd) runs the logging daemon. It must be enabled so it starts automatically at boot and active so it is running in the current session; an enabled-and-active service ensures log collection begins at boot and continues without manual intervention.

If the rsyslog service is not running and enabled at boot, the system stops capturing and persisting log messages, leaving gaps in the record of system and security events that accountability, detection, and investigation depend on.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Run the following commands to unmask, enable, and start rsyslog.service :

# systemctl unmask rsyslog.service
# systemctl enable rsyslog.service
# systemctl start rsyslog.service

Impact:

None. rsyslog is enabled and active by default on supported platforms; enabling and starting an installed service has negligible operational impact.

See Also

https://workbench.cisecurity.org/benchmarks/27893

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-3, 800-53|AU-7, 800-53|AU-12, CSCv7|6.2, CSCv7|6.3

Plugin: Unix

Control ID: 7a03d00f5e8182354dacaadc87948440ef845d43c7d92fe56bce1da397ed1277