Skip to content
Log In

The Oracle Linux operating system must send rsyslog output to a log aggregation server.

An XCCDF Rule

Description

Sending rsyslog output to another system ensures that the logs cannot be removed or modified in the event that the system is compromised or has a hardware failure.

ID
SV-221835r991589_rule
Version
OL07-00-031000
Severity
Medium
References
Updated

Remediation Templates

A Manual Procedure

Modify the "/etc/rsyslog.conf" or an "/etc/rsyslog.d/*.conf" file to contain a configuration line to send all "rsyslog" output to a log aggregation server:

For UDP:
     *.* @[logaggregationserver.example.mil]:[port]

For TCP: 
     *.* @@[logaggregationserver.example.mil]:[port]