Cis Ubuntu2004 V300 6 2 3 1

6.2.3.1 Ensure rsyslog service is enabled and active (Automated)

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

Once the rsyslog package is installed, ensure that the service is enabled.

Rationale

If the rsyslog service is not enabled to start on boot, the system will not capture logging events.

Audit Procedure

Command Line

• IF - rsyslog is being used for logging on the system:

Run the following command to verify rsyslog.service is enabled:

# systemctl is-enabled rsyslog

Run the following command to verify rsyslog.service is active:

# systemctl is-active rsyslog.service

Expected Result

enabled
active

Remediation

Command Line

• IF - rsyslog is being used for logging on the system:

Run the following commands to unmask, enable, and start rsyslog.service:

# systemctl unmask rsyslog.service
# systemctl enable rsyslog.service
# systemctl start rsyslog.service

Default Value

Enabled and active by default.

References

1. NIST SP 800-53 Rev. 5: AU-2, AU-3, AU-12

CIS Controls

MITRE ATT&CK Mappings