← Rules Catalog
lowloggingverified rollback-safe

Ensure systemd-journal-remote is installed

journald-remote-installed · RHEL ≥ 8 · 2 impls

Description

If centralized logging is required, the systemd-journal-remote package provides the capability to send journal entries to a remote server.

Rationale

Centralized logging enables correlation of events across multiple systems and protects log integrity in case of system compromise. The package must be installed before configuration.

Check → Remediate

Checkpackage_state
name:
systemd-journal-remote
state:
present
Remediatepackage_present
name:
systemd-journal-remote

Framework references

CIS

rhel8 6.2.1.2.1rhel9 6.2.2.1.1rhel10 6.2.2.1.1

NIST 800-53

AU-6AU-12

Live verification

rhel10:checkrhel8:checkrhel9:check
#journald#remote#logging#package