lowloggingverified ✓

Ensure rsyslog logrotate is configured

rsyslog-logrotate-configured · RHEL ≥ 8 · 1 impl

Description

A logrotate configuration for the rsyslog-managed log files (/etc/logrotate.d/syslog or equivalent) must exist so system logs are rotated rather than growing without bound.

Rationale

Without logrotate coverage, syslog files grow until they exhaust disk, risking log loss and denial of service.

Check → Remediate

Checkcommand

if ls /etc/logrotate.d/syslog >/dev/null 2>&1 && \
   grep -qsE '/var/log/(messages|secure|maillog|cron|spooler|boot\.log)' /etc/logrotate.d/syslog; then
  echo "OK: rsyslog logrotate configured"; exit 0
fi
echo "FAIL: /etc/logrotate.d/syslog missing or does not rotate the standard rsyslog files"; exit 1

expected_exit:: 0

Remediatemanual

note:: Provide /etc/logrotate.d/syslog covering the rsyslog-managed files (/var/log/messages, secure, maillog, cron, spooler, boot.log) with the site retention policy.

Framework references

CIS

rhel9 6.2.3.8rhel8 6.2.2.8rhel10 6.2.3.8

NIST 800-53

AU-4

Live verification

rhel9:check

#rsyslog#logrotate#logging