mediumloggingunverified
Ensure the systemd-journald service is active
journald-service-active · RHEL ≥ 8 · 1 impl
Description
The systemd-journald service must be active so the system captures and retains log data.
Rationale
Without journald running, security-relevant events are not recorded, defeating detection, incident response, and audit.
Check → Remediate
Checkcommand
systemctl is-active systemd-journald 2>/dev/null | grep -q '^active$'
- expected_exit:
- 0
Remediatemanual
- note:
- systemctl unmask systemd-journald && systemctl start systemd-journald
Framework references
CIS
rhel8 6.2.1.1.1rhel10 6.2.1.1
STIG
V-281096 / RHEL-10-500000
NIST 800-53
AU-12
#journald#logging#systemd#cis