cis-ubuntu2004-v300-6-2-1-3

6.2.1.3 Ensure journald log file rotation is configured (Manual)

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

Journald includes the capability of rotating log files regularly to avoid filling up the system with logs or making the logs unmanageably large. The file /etc/systemd/journald.conf is the configuration file used to specify how logs generated by Journald should be rotated.

Rationale

By keeping the log files smaller and more manageable, a system administrator can easily archive these files to another system and spend less time looking through inordinately large log files.

Audit Procedure

Command Line

Review the systemd-journald configuration. Verify logs are rotated according to site policy. The specific parameters for log rotation are:

Run the following script and review the output to ensure logs are rotated according to site policy:

#!/usr/bin/env bash
{
    a_output=() a_output2=() l_analyze_cmd="$(readlink -f /bin/systemd-analyze)"
    l_systemd_config_file="systemd/journald.conf"
    a_parameters=("SystemMaxUse=^.+
quot; "SystemKeepFree=^.+
quot; "RuntimeMaxUse=^.+
quot; "RuntimeKeepFree=^.+
quot;
    "MaxFileSec=^.+
quot;)
    # ... (full audit script from benchmark)
}

Expected Result

Review the output to verify log rotation parameters are configured according to site policy.

Remediation

Command Line

Edit /etc/systemd/journald.conf or a file ending in .conf the /etc/systemd/journald.conf.d/ directory. Set the following parameters in the [Journal] section to ensure logs are rotated according to site policy. The settings should be carefully understood as there are specific edge cases and prioritization of parameters.

Example Configuration:

[Journal]
SystemMaxUse=1G
SystemKeepFree=500M
RuntimeMaxUse=200M
RuntimeKeepFree=50M
MaxFileSec=1month

Example script to create systemd drop-in configuration file:

{
    a_settings=("SystemMaxUse=1G" "SystemKeepFree=500M" "RuntimeMaxUse=200M" "RuntimeKeepFree=50M"
    "MaxFileSec=1month")
    [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/
    if grep -Psq -- '^\h*\[Journal\]' /etc/systemd/journald.conf.d/60-journald.conf; then
        printf '%s\n' "" "${a_settings[@]}" >> /etc/systemd/journald.conf.d/60-journald.conf
    else
        printf '%s\n' "" "[Journal]" "${a_settings[@]}" >> /etc/systemd/journald.conf.d/60-journald.conf
    fi
}

Note:

• If these settings appear in a canonically later file, or later in the same file, the setting will be overwritten
• Logfile size and configuration to move logfiles to a remote log server should be accounted for when configuring these settings

Run to following command to update the parameters in the service:

# systemctl reload-or-restart systemd-journald

Default Value

Not specifically configured by default.

References

1. NIST SP 800-53 Rev. 5: AU-2, AU-7, AU-12

CIS Controls

MITRE ATT&CK Mappings