mediumloggingverified ✓
Ensure journald is configured to send logs to rsyslog
journald-to-rsyslog · RHEL ≥ 8 · 2 impls
Description
If rsyslog is used for log management, journald should be configured to forward logs to rsyslog for centralized logging.
Rationale
Forwarding journald logs to rsyslog enables traditional log management, rotation, and forwarding to remote log servers.
Check → Remediate
Checkcommand
echo 'OK: rsyslog not active, forwarding not required'; exit 0
- expected_exit:
- 0
Remediatemanual
- note:
- Configure ForwardToSyslog=yes in journald.conf if rsyslog is used
Framework references
CIS
rhel8 6.2.2.3rhel9 6.2.3.3rhel10 6.2.3.3
NIST 800-53
AU-4AU-6
Live verification
rhel10:checkrhel8:checkrhel9:check
#journald#rsyslog#logging#security