lowfilesystemverified ✓

Ensure /var/log is on a separate filesystem

mount-var-log-separate-fs · RHEL ≥ 8 · 1 impl

Description

The /var/log directory must be on a separate filesystem or logical volume. A dedicated partition for /var/log prevents log growth from consuming the /var or root filesystem.

Rationale

Without a separate /var/log filesystem, log file accumulation could fill the /var or root filesystem, potentially disrupting system operations and preventing further audit logging. A separate partition provides isolation.

Check → Remediate

Checkcommand

findmnt /var/log 2>/dev/null | grep -v '^TARGET' | awk '{print $1}' | grep -q '/var/log$'

expected_exit:: 0

Remediatemanual

note:: Create a separate partition or logical volume for /var/log and add it to /etc/fstab. Migrate existing log data to the new partition.

Framework references

CIS

rhel9 1.1.2.6.1rhel10 1.1.2.6.1rhel8 1.1.2.6.1

STIG

V-280940 / RHEL-10-000560V-230293

NIST 800-53

CM-6AU-4

Live verification

rhel10:checkrhel8:checkrhel9:check

#mount#var-log#filesystem#hardening