lowloggingverified ✓

Ensure journald log file rotation is configured

journald-log-rotation · RHEL ≥ 8 · 1 impl

Description

journald must have an explicit size or time based rotation limit (SystemMaxUse, SystemKeepFree, RuntimeMaxUse, or MaxFileSec) so journals cannot grow without bound.

Rationale

Unbounded journals can exhaust disk space, causing loss of logs or denial of service. Explicit rotation limits keep log storage predictable.

Check → Remediate

Checkcommand

if grep -rhsE '^\s*(SystemMaxUse|SystemKeepFree|RuntimeMaxUse|MaxFileSec)\s*=' \
     /etc/systemd/journald.conf /etc/systemd/journald.conf.d/ 2>/dev/null | grep -q .; then
  echo "OK: journald rotation limit configured"; exit 0
fi
echo "FAIL: no journald rotation limit (SystemMaxUse/MaxFileSec/...) set"; exit 1

expected_exit:: 0

Remediatemanual

note:: Set a rotation limit in /etc/systemd/journald.conf (for example SystemMaxUse=... or MaxFileSec=1month) and restart systemd-journald.

Framework references

CIS

rhel9 6.2.1.3rhel8 6.2.1.1.3rhel10 6.2.1.3

NIST 800-53

AU-4

Live verification

rhel9:check

#journald#logging#rotation