TMAegisBeta
Thêm quy tắc cho linux

Linux distributions

TMA-RHEL10-6.2.1.4

Ensure only one logging system is in use

Trung bìnhCấp 1Tự độnglinux

Mô tả

Best practices recommend that a single centralized logging system be used for log management, choose a single service either rsyslog - OR - journald to be used as a single centralized logging system.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell
alt0() { o=$(bash -c '#!/usr/bin/env bash

{
    l_output="" l_output2="" # Check the status of rsyslog and journald
    if systemctl is-active --quiet rsyslog; then
        l_output="$l_output\n - rsyslog is in use\n- follow the recommendations in Configure rsyslog subsection only"
    elif systemctl is-active --quiet systemd-journald; then
        l_output="$l_output\n - journald is in use\n- follow the recommendations in Configure journald subsection only"
    else
        echo -e “unable to determine system logging”
        l_output2="$l_output2\n - unable to determine system logging\n- Configure only ONE system logging: rsyslog OR journald"
    fi
    if [ -z "$l_output2" ]; then  # Provide audit results
        echo -e "\n- Audit Result:\n  ** PASS **\n$l_output\n"
    else
        echo -e "\n- Audit Result:\n  ** FAIL **\n - Reason(s) for audit failure:\n$l_output2"
    fi
}' 2>&1); printf '%s\n' "$o" | grep -q '\*\* PASS \*\*' || { echo "step1: script did not report PASS"; return 1; }; }; if alt0; then echo compliant; fi
Đầu ra mong đợi
compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

1. Determine whether to use journald - OR - rsyslog depending on site needs 2. Configure systemd-jounald.service 3. Configure only ONE either journald - OR - rsyslog and complete the recommendations in that subsection 4. Return to this recommendation to ensure only one logging system is in use 6.2.2 Configure journald Included in the systemd suite is a journaling service called systemd-journald.service for the collection and storage of logging data. It creates and maintains structured, indexed journals based on logging information that is received from a variety of sources such as: Classic RFC3164 BSD syslog via the /dev/log socket STDOUT/STDERR of programs via StandardOutput=journal + Stand…

Thuộc tính

Hệ điều hành
rhel-10
Thẻ
cis-convertedlinux
Tham chiếu
CIS Red Hat Enterprise Linux 10 Benchmark v1.0.1 - 6.2.1.4

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell
tmaegis scan --target linux