Ensure that logging is enabled

MediumLevel 1Automatedcassandra

Description

Apache Cassandra uses Logback for logging functionality. While this can be set using nodetool setlogginglevel changes made using this method will be reverted to the level specified in the logback.xml file the next time the process restarts. The configurable logging levels are: - OFF - TRACE - DEBUG - INFO (Default) - WARN - ERROR Runs nodetool getlogginglevels (JMX on localhost:7199); passes when the ROOT logger is not OFF.

How it is checked

Audit method: Shell command

shell

out=$(nodetool getlogginglevels 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '$1 == "ROOT" {r = $2} END {if (r == "") print "no ROOT logger"; else if (toupper(r) == "OFF") print "OFF"; else print "compliant"}'

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Set <root level="INFO"> in logback.xml (or logback-test.xml if present) and restart Cassandra, or run nodetool setlogginglevel ROOT INFO.

Properties

Operating systems: Any
Tags: cassandralogging
Reference: CIS Apache Cassandra 5.0 Benchmark v1.1.0 - 4.1 Ensure that logging is enabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target cassandra