UBTU-18-010022 - The Ubuntu operating system must be configured to preserve log records from failure events.


Failure to a known state can address safety or security in accordance with the mission/business needs of the organization. Failure to a known secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system.

Preserving operating system state information helps to facilitate operating system restart and return to the operational mode of the organization with least disruption to mission/business processes.


Configure the log service to collect failure events.

Install the log service (if the log service is not already installed) with the following command:

# sudo apt-get install rsyslog

Enable the log service with the following command:

# sudo systemctl enable rsyslog

Restart the log service with the following command:

# sudo systemctl restart rsyslog

See Also


Item Details

References: CAT|II, CCI|CCI-001665, Rule-ID|SV-219160r610963_rule, STIG-ID|UBTU-18-010022, STIG-Legacy|SV-109651, STIG-Legacy|V-100547, Vuln-ID|V-219160

Plugin: Unix

Control ID: e098c43547aa2c10f99d98a863f6bcfc15a6185309355111b6d7e8cc033058d2