lowloggingverified ✓

Ensure systemd-journal-upload is configured

journald-upload-configured · RHEL ≥ 8 · 1 impl

Description

If centralized logging is required, the systemd-journal-upload service must be configured to send journal entries to a remote server. The upload URL must be set to a valid log collection endpoint.

Rationale

Centralized logging enables correlation of events across multiple systems and protects log integrity in case of system compromise. Proper configuration ensures logs are forwarded securely.

Check → Remediate

Checkcommand

grep -E '^URL=' /etc/systemd/journal-upload.conf 2>/dev/null | grep -v '^#'

expected_exit:: 0

Remediatemanual

note:: Configure journal-upload by editing /etc/systemd/journal-upload.conf and setting URL= to your log collection server. Example: URL=https://logs.example.com:19532

Framework references

CIS

rhel9 6.2.2.1.2rhel10 6.2.2.1.2

NIST 800-53

AU-6AU-12

Live verification

rhel10:checkrhel9:check

#journald#remote#logging#configuration