mediumloggingverified ✓

Ensure rsyslog logging is configured

rsyslog-logging-configured · RHEL ≥ 8 · 1 impl

Description

When rsyslog is the system logger it must have active logging selectors configured (in /etc/rsyslog.conf or /etc/rsyslog.d/*.conf) so that system events are actually recorded.

Rationale

rsyslog installed but without logging rules records nothing. Explicit selectors ensure security-relevant events reach persistent logs.

Check → Remediate

Checkcommand

if ! rpm -q rsyslog >/dev/null 2>&1; then echo "FAIL: rsyslog not installed"; exit 1; fi
if grep -rhsE '^[^#]*\S+\.\S+\s+(/|-/|@|:)' /etc/rsyslog.conf /etc/rsyslog.d/ 2>/dev/null | grep -q .; then
  echo "OK: rsyslog logging selectors present"; exit 0
fi
echo "FAIL: no active rsyslog logging selectors"; exit 1

expected_exit:: 0

Remediatemanual

note:: Configure logging selectors in /etc/rsyslog.conf or a file under /etc/rsyslog.d/ per the site logging policy, then restart rsyslog.

Framework references

CIS

rhel9 6.2.3.5rhel8 6.2.2.5rhel10 6.2.3.5

NIST 800-53

AU-12

Live verification

rhel9:check

#rsyslog#logging