systemd-journal-upload.service fails to start after hardening with `cis` profiles

[matusmarhefka]

Description of problem:

After system is hardened with any variant of cis profile and rebooted, the systemd-journal-upload.service fails to start.

SCAP Security Guide Version:

master

Operating System Version:

RHEL 10

Steps to Reproduce:

1. Run /scanning/boot-errors test for any of the affected profiles.

Actual Results:

systemd-journal-upload: Required --url=/-u option missing.
systemd-journal-upload: Required --url=/-u option missing.
systemd-journal-upload: Required --url=/-u option missing.
systemd: Failed to start systemd-journal-upload.service - Journal Remote Upload Service.

Status of the service on affected system:

× systemd-journal-upload.service - Journal Remote Upload Service
     Loaded: loaded (/usr/lib/systemd/system/systemd-journal-upload.service; enabled; preset: disabled)
     Active: failed (Result: exit-code) since Wed 2026-03-11 16:13:17 CET; 10s ago
   Duration: 46ms
 Invocation: 6fe4b6a4f741476794b0303fa2b1715b
       Docs: man:systemd-journal-upload(8)
    Process: 4083 ExecStart=/usr/lib/systemd/systemd-journal-upload --save-state (code=exited, status=1/FAILURE)
   Main PID: 4083 (code=exited, status=1/FAILURE)
      Error: code: 22 (Invalid argument)

Mar 11 16:13:15 localhost.localdomain systemd[1]: systemd-journal-upload.service: Failed with result 'exit-code'.
Mar 11 16:13:17 localhost.localdomain systemd[1]: systemd-journal-upload.service: Scheduled restart job, restart counter is at 5.
Mar 11 16:13:17 localhost.localdomain systemd[1]: systemd-journal-upload.service: Start request repeated too quickly.
Mar 11 16:13:17 localhost.localdomain systemd[1]: systemd-journal-upload.service: Failed with result 'exit-code'.
Mar 11 16:13:17 localhost.localdomain systemd[1]: Failed to start systemd-journal-upload.service - Journal Remote Upload Service.

Expected Results:

No failure after hardening.

[jan-cerny]

Often we experienced a situation that this service failed to start because there was no URL configured to where the logs should be uploaded. This issue might be the same problem. In past, we had this service failed to start in our Automatus tests and we solved it by setting the URL in the test scenarios. https://github.com/ComplianceAsCode/content/pull/14265/changes. Unfortunately, this URL of the log server is individual to each customer and therefore we can't hardcode it to the content.

[matusmarhefka]

@jan-cerny Right, so as there is no solution on our side possible we move the waiver to permanent waivers. We already have related waiver at https://github.com/RHSecurityCompliance/contest/blob/2425473d946f8cc6c9d8c94736233a10a13b6420/conf/waivers/permanent#L20-L23 so we can group them together.

[matusmarhefka]

Resolved by RHSecurityCompliance/contest#582