← Rules Catalog
lowloggingverified rollback-safe

Ensure systemd-journal-upload is enabled

journald-upload-enabled · RHEL ≥ 8 · 1 impl

Description

If centralized logging is required, the systemd-journal-upload service must be enabled to send journal entries to a remote log collection server.

Rationale

Without the journal-upload service enabled, log entries will not be forwarded to centralized logging infrastructure, potentially leaving gaps in security monitoring.

Check → Remediate

Checkservice_state
name:
systemd-journal-upload.service
enabled:
true
Remediateservice_enabled
name:
systemd-journal-upload.service

Framework references

CIS

rhel8 6.2.1.2.3rhel9 6.2.2.1.3rhel10 6.2.2.1.3

NIST 800-53

AU-6AU-12

Live verification

rhel10:checkrhel8:checkrhel9:check
#journald#remote#logging#service