The Red Hat Enterprise Linux operating system must send rsyslog output to a log aggregation server.

From Red Hat Enterprise Linux 7 Security Technical Implementation Guide

Associated with: CCI-000366

SV-86833r2_rule The Red Hat Enterprise Linux operating system must send rsyslog output to a log aggregation server.

Vulnerability discussion

Sending rsyslog output to another system ensures that the logs cannot be removed or modified in the event that the system is compromised or has a hardware failure.

Check content

Verify "rsyslog" is configured to send all messages to a log aggregation server. Check the configuration of "rsyslog" with the following command: Note: If another logging package is used, substitute the utility configuration file for "/etc/rsyslog.conf". # grep @ /etc/rsyslog.conf /etc/rsyslog.d/*.conf *.* @@logagg.site.mil If there are no lines in the "/etc/rsyslog.conf" or "/etc/rsyslog.d/*.conf" files that contain the "@" or "@@" symbol(s), and the lines with the correct symbol(s) to send output to another system do not cover all "rsyslog" output, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media. If the lines are commented out or there is no evidence that the audit logs are being sent to another system, this is a finding.

Fix text

Modify the "/etc/rsyslog.conf" or an "/etc/rsyslog.d/*.conf" file to contain a configuration line to send all "rsyslog" output to a log aggregation system: *.* @@

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.