TMA-BOTTLEROCKET-4.1.1.1

Ensure journald is configured to write logs to persistent disk

MediumLevel 1Automatedbottlerocket

Description

Data from the journal may be stored in volatile memory or persisted locally on the server. Logs in memory will be lost upon a system reboot. By persisting logs to local disk on the server they are protected from loss. The audit requires Storage=persistent in /usr/lib/systemd/journald.conf.d/journald.conf. Run tmaegis on the host through the admin container root shell (sudo sheltie).

How it is checked

Audit method: Shell command

shell

f=/usr/lib/systemd/journald.conf.d/journald.conf
[ -r "$f" ] || exit 1
grep -Eq '^[[:space:]]*Storage=persistent[[:space:]]*$' "$f" && echo compliant || echo "Storage=persistent not set in $f"

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Update to a version of the OS with the correct journald configuration.

Properties

Operating systems: Any
Tags: bottlerocketlogging
Reference: CIS Bottlerocket Benchmark v1.0.0 - 4.1.1.1 Ensure journald is configured to write logs to persistent disk

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target bottlerocket