lowloggingverified ✓rollback-safe
Ensure systemd-journal-upload is enabled
journald-upload-enabled · RHEL ≥ 8 · 1 impl
Description
If centralized logging is required, the systemd-journal-upload service must be enabled to send journal entries to a remote log collection server.
Rationale
Without the journal-upload service enabled, log entries will not be forwarded to centralized logging infrastructure, potentially leaving gaps in security monitoring.
Check → Remediate
Checkservice_state
- name:
- systemd-journal-upload.service
- enabled:
- true
Remediateservice_enabled
- name:
- systemd-journal-upload.service
Framework references
CIS
rhel8 6.2.1.2.3rhel9 6.2.2.1.3rhel10 6.2.2.1.3
NIST 800-53
AU-6AU-12
Live verification
rhel10:checkrhel8:checkrhel9:check
#journald#remote#logging#service