Ensure Log Storage and Rotation Is Configured Correctly

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Perform the following steps to determine if the recommended state is implemented: 1. Verify the web log rotation configuration matches the Apache configured log files. 2. Verify the rotation period and number of logs to retain is at least 13 weeks or 3 months. 3. For each virtual host configured with its own log files ensure that those log files are also included in a similar log rotation.

修正方法

修正方法: ガイダンスまたは IaC パッチ

To implement the recommended state, do either option 'a' if using the Linux logrotate utility or option 'b' if using a piped logging utility such as the Apache rotatelogs: a) File Logging with Logrotate: 1. Add or modify the web log rotation configuration to match your configured log files in /etc/logrotate.d/httpdor '/etc/logrotate.d/apache2' to be similar to the following. /var/log/httpd/*log { missingok notifempty sharedscripts postrotate /bin/kill -HUP 'cat /var/run/httpd.pid 2>/dev/null' 2> /dev/null || true endscript } 2. Modify the rotation period and number of logs to keep so that at least 13 weeks or 3 months of logs are retained. This may be done as the default value for all logs in /etc/logrotate.conf or in the web specific log rotation configuration in /etc/logrotate.d/httpdto be similar to the following.