Cis Ubuntu2004 V300 6 2 2 3

6.2.2.3 Ensure journald Compress is configured (Automated)

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

The journald system includes the capability of compressing overly large files to avoid filling up the system with logs or making the logs unmanageably large.

Rationale

Uncompressed large files may unexpectedly fill a filesystem leading to resource unavailability. Compressing logs prior to write can prevent sudden, unexpected filesystem impacts.

Note: This recommendation only applies if journald is the chosen method for client side logging. Do not apply this recommendation if rsyslog is used.

Audit Procedure

Command Line

• IF - journald is the method for capturing logs

Run the following command to verify Compress is set to yes:

# grep -Psi "^Compress=yes" /etc/systemd/journald.conf /etc/systemd/journald.conf.d/*

Expected Result

Compress=yes

Remediation

Command Line

• IF - rsyslog is the preferred method for capturing logs, this section and Recommendation should be skipped and the "Configure rsyslog" section followed.
• IF - journald is the preferred method for capturing logs:

Set the following parameter in the [Journal] section in /etc/systemd/journald.conf or a file in /etc/systemd/journald.conf.d/ ending in .conf:

Compress=yes

Note: If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten.

Run to following command to update the parameters in the service:

# systemctl reload-or-restart systemd-journald

Default Value

Compress=yes

References

1. NIST SP 800-53 Rev. 5: AU-4

CIS Controls

MITRE ATT&CK Mappings