Profile Applicability:
Level 1

Description:
 The systemd journal (journald) can forward log messages to the traditional syslog daemon (rsyslog). Disabling this forwarding prevents duplicate logging, reduces system overhead, and minimizes potential security risks from unnecessary log transmission.

Rationale:
 Preventing journald from forwarding logs to rsyslog reduces redundancy and limits the exposure of sensitive log data, improving overall system security and performance.

Impact:
 Pros:

  • Reduces log duplication and storage usage.

  • Decreases inter-process communication overhead.

  • Minimizes risk of unintended log exposure.

Cons:

  • Systems relying on rsyslog for centralized logging may lose log data if forwarding is disabled.

Default Value:
 Forwarding logs to rsyslog is often enabled by default.

Pre-requisites:

  • Root or sudo privileges to modify systemd journal configuration.

Remediation:

Test Plan:

Using Linux command line:

  1. Check the forwarding setting in /etc/systemd/journald.conf:

    grep ForwardToSyslog /etc/systemd/journald.conf

  2. Verify that ForwardToSyslog is set to no.

Implementation Plan:

Using Linux command line:

  1. Edit the journald configuration file:

    vi /etc/systemd/journald.conf

  2. Set the parameter to disable forwarding:

    ForwardToSyslog=no

  3. Save the file and restart the journald service:

    systemctl restart systemd-journald

  4. Confirm the change:

    grep ForwardToSyslog /etc/systemd/journald.conf


Backout Plan:

Using Linux command line:

  1. Re-enable forwarding if necessary by setting:

    ForwardToSyslog=yes

  2. Restart journald service:

    systemctl restart systemd-journald

  3. Verify forwarding is active.

References: