Cron logging must be implemented.

From Oracle Linux 5 Security Technical Implementation Guide

Associated with: CCI-000126

SV-64313r2_rule Cron logging must be implemented.

Vulnerability discussion

Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used to spot intrusions into the use of the cron facility by unauthorized and malicious users.

Check content

Depending on what system is used for log processing either /etc/syslog.conf or /etc/rsyslog.conf will be the logging configuration file. # grep cron /etc/syslog.conf Or: # grep cron /etc/rsyslog.conf If cron logging is not configured, this is a finding. Check the configured cron log file found in the cron entry of /etc/syslog.conf or /etc/rsyslog.conf (normally /var/log/cron). # ls -lL /var/log/cron If this file does not exist, or is older than the last cron job, this is a finding.

Fix text

Edit /etc/syslog.conf or /etc/rsyslog.conf and setup cron logging.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.