cyberstrikeus 5.1.1.2 Ensure journald service is enabled (Automated)
Profile
- Level: 1 - Server
- Level: 1 - Workstation
- Assessment Status: Automated
Description
Ensure that the systemd-journald service is enabled to allow capturing of logging events.
Rationale
If the systemd-journald service is not enabled to start on boot, the system will not capture logging events.
Audit Procedure
Command Line
Run the following command to verify systemd-journald is enabled:
systemctl is-enabled systemd-journald.service
Verify the output matches:
static
Expected Result
The output should show static.
Remediation
Command Line
By default the systemd-journald service does not have an [Install] section and thus cannot be enabled / disabled. It is meant to be referenced as Requires or Wants by other unit files. As such, if the status of systemd-journald is not static, investigate why.
Default Value
static
References
- NIST SP 800-53 Rev. 5: AU-2, AU-7, AU-12
CIS Controls
| Controls Version | Control |
|---|---|
| v8 | 8.2 Collect Audit Logs - Collect audit logs. Ensure that logging, per the enterprise's audit log management process, has been enabled across enterprise assets. |
| v7 | 6.2 Activate audit logging - Ensure that local logging has been enabled on all systems and networking devices. |
| v7 | 6.3 Enable Detailed Logging - Enable system logging to include detailed information such as an event source, date, user, timestamp, source addresses, destination addresses, and other useful elements. |