Detections
Analytics

6.1.1.2.3 Ensure systemd-journal-upload is enabled and active

Information

Journald systemd-journal-upload supports the ability to send log events it gathers to a remote log host.

Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.

Solution

Run the following commands to unmask, enable and start systemd-journal-upload :

# systemctl unmask systemd-journal-upload.service
# systemctl --now enable systemd-journal-upload.service

See Also

https://workbench.cisecurity.org/benchmarks/24330

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, CSCv7|6.2, CSCv7|6.3

Plugin: Unix

Control ID: 9be84ca3f0e393aaa9c03d0c5f50b5553caeffb745936b99a64cef8a0d76586a