Skip to content

Commit c310b8c

Browse files
Mab879Mab879
authored
Merge pull request #14242 from vojtapolasek/cis_only_one_logging_system
RHEL 10 CIS: Implement 6.2.1.4
2 parents 05d742f + 57e1a04 commit c310b8c

14 files changed

Lines changed: 141 additions & 5 deletions

File tree

‎components/rsyslog.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ packages:
99
- rsyslog-gnutls
1010
rules:
1111
- disable_logwatch_for_logserver
12+
- ensure_journald_and_rsyslog_not_active_together
1213
- ensure_logrotate_activated
1314
- ensure_rtc_utc_configuration
1415
- file_groupowner_var_log_syslog

‎components/systemd.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ rules:
1313
- dir_groupowner_system_journal
1414
- disable_ctrlaltdel_burstaction
1515
- disable_ctrlaltdel_reboot
16+
- ensure_journald_and_rsyslog_not_active_together
1617
- file_groupowner_etc_crypttab
1718
- file_groupowner_journalctl
1819
- file_groupowner_system_journal

‎controls/cis_rhel10.yml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2377,10 +2377,9 @@ controls:
23772377
levels:
23782378
- l1_server
23792379
- l1_workstation
2380-
status: pending
2381-
notes: |-
2382-
It is necessary to create a new rule to check the status of journald and rsyslog.
2383-
It would also be necessary a new rule to disable or remove rsyslog.
2380+
status: automated
2381+
rules:
2382+
- ensure_journald_and_rsyslog_not_active_together
23842383

23852384
- id: 6.2.2.1.1
23862385
title: Ensure systemd-journal-remote is installed (Automated)

‎linux_os/guide/system/logging/ensure_journald_and_rsyslog_not_active_together/oval/shared.xml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
<def-group>
2+
<definition class="compliance" id="{{{ rule_id }}}" version="1">
3+
{{{ oval_metadata("Ensure journald and rsyslog are not active together", rule_title=rule_title) }}}
4+
<criteria>
5+
<criterion comment="both logging services are not active together"
6+
test_ref="test_{{{ rule_id }}}_not_both_active"/>
7+
</criteria>
8+
</definition>
9+
10+
<linux:systemdunitproperty_object id="obj_{{{ rule_id }}}_logging_services" version="1"
11+
comment="Active logging services">
12+
<linux:unit operation="pattern match">^(rsyslog|systemd-journald).service$</linux:unit>
13+
<linux:property>ActiveState</linux:property>
14+
<filter action="include">ste_{{{ rule_id }}}_logging_services</filter>
15+
</linux:systemdunitproperty_object>
16+
17+
<linux:systemdunitproperty_state id="ste_{{{ rule_id }}}_logging_services" version="1">
18+
<linux:value>active</linux:value>
19+
</linux:systemdunitproperty_state>
20+
21+
<!-- Count active logging services -->
22+
<local_variable id="var_{{{ rule_id }}}_logging_service_active_count" datatype="int" version="1"
23+
comment="Number of currently active logging services">
24+
<count>
25+
<regex_capture pattern="^active$">
26+
<object_component item_field="value" object_ref="obj_{{{ rule_id }}}_logging_services"/>
27+
</regex_capture>
28+
</count>
29+
</local_variable>
30+
31+
<!-- Test that exactly one logging service is active -->
32+
<ind:variable_test id="test_{{{ rule_id }}}_not_both_active" version="1" check="all"
33+
comment="Verify exactly one logging service is active">
34+
<ind:object object_ref="obj_{{{ rule_id }}}_count"/>
35+
<ind:state state_ref="ste_{{{ rule_id }}}_count"/>
36+
</ind:variable_test>
37+
38+
<ind:variable_object id="obj_{{{ rule_id }}}_count" version="1">
39+
<ind:var_ref>var_{{{ rule_id }}}_logging_service_active_count</ind:var_ref>
40+
</ind:variable_object>
41+
42+
<ind:variable_state id="ste_{{{ rule_id }}}_count" version="1">
43+
<ind:value operation="equals" datatype="int">1</ind:value>
44+
</ind:variable_state>
45+
</def-group>

‎linux_os/guide/system/logging/ensure_journald_and_rsyslog_not_active_together/rule.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
documentation_complete: true
2+
3+
title: 'Ensure journald and rsyslog Are Not Active Together'
4+
5+
description: |-
6+
Ensure that exactly one logging system is active. Running both rsyslog and
7+
systemd-journald simultaneously can lead to duplicate logging, resource
8+
contention, and configuration conflicts. Running neither service means no
9+
logging is occurring, which is also a violation.
10+
<pre>
11+
systemctl is-active rsyslog systemd-journald
12+
</pre>
13+
The command should return exactly one <tt>active</tt> service. Both services
14+
should not be active at the same time, and at least one must be active.
15+
16+
rationale: |-
17+
Running multiple logging systems concurrently can cause conflicts, resource
18+
contention, and inconsistent logging behavior. Systems should use either
19+
rsyslog or systemd-journald, but not both simultaneously. This ensures
20+
predictable logging behavior and prevents potential issues with log
21+
duplication or loss.
22+
23+
severity: medium
24+
25+
identifiers:
26+
cce@rhel10: CCE-90723-8
27+
28+
platform: machine
29+
30+
warnings:
31+
- general: |-
32+
This rule does not come with a remediation. The choice of logging
33+
system (rsyslog vs systemd-journald) is an architectural decision
34+
that should be made based on organizational requirements. Use
35+
service_rsyslog_enabled/disabled or service_systemd-journald_enabled
36+
rules to configure the desired logging system.
37+
38+
ocil_clause: 'both rsyslog and systemd-journald services are active, or neither service is active'
39+
40+
ocil: |-
41+
To verify that exactly one logging system is active, run the following command:
42+
<pre>systemctl is-active rsyslog systemd-journald | grep -c active</pre>
43+
The output should be exactly 1. If the output is 0, no logging is active.
44+
If the output is 2, both logging systems are active simultaneously. Both
45+
cases are findings.

‎linux_os/guide/system/logging/ensure_journald_and_rsyslog_not_active_together/tests/both_active.fail.sh‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/bash
2+
#
3+
# packages = rsyslog
4+
5+
# Ensure both services are active
6+
systemctl start rsyslog
7+
systemctl start systemd-journald
8+
9+
# Verify both are running
10+
systemctl is-active rsyslog systemd-journald

‎linux_os/guide/system/logging/ensure_journald_and_rsyslog_not_active_together/tests/none_active.fail.sh‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/bin/bash
2+
#
3+
# packages = rsyslog
4+
# remediation = none
5+
6+
# Stop both logging services
7+
systemctl stop systemd-journald
8+
systemctl stop rsyslog
9+
systemctl mask systemd-journald
10+
systemctl mask rsyslog
11+
12+
# Verify both are stopped
13+
! systemctl is-active rsyslog
14+
! systemctl is-active systemd-journald

‎linux_os/guide/system/logging/ensure_journald_and_rsyslog_not_active_together/tests/only_journald.pass.sh‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#!/bin/bash
2+
#
3+
# packages = rsyslog
4+
5+
# Stop and mask rsyslog, ensure journald is active
6+
systemctl stop rsyslog
7+
systemctl mask rsyslog
8+
systemctl start systemd-journald
9+
10+
# Verify only journald is running
11+
systemctl is-active systemd-journald

‎linux_os/guide/system/logging/ensure_journald_and_rsyslog_not_active_together/tests/only_rsyslog.pass.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/bash
2+
#
3+
# packages = rsyslog
4+
5+
systemctl start rsyslog
6+
systemctl stop systemd-journald.socket systemd-journald-dev-log.socket 2> /dev/null
7+
systemctl stop systemd-journald 2>/dev/null

‎shared/references/cce-redhat-avail.txt‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2400,4 +2400,3 @@ CCE-90719-6
24002400
CCE-90720-4
24012401
CCE-90721-2
24022402
CCE-90722-0
2403-
CCE-90723-8

0 commit comments

Comments
 (0)