Enable rsyslog Service

An XCCDF Rule

Description

The rsyslog service provides syslog-style logging by default on Red Hat Enterprise Linux 8. The rsyslog service can be enabled with the following command:

$ sudo systemctl enable rsyslog.service

Rationale

The rsyslog service must be running in order to provide logging services, which are essential to system administration.

ID: xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Severity: Medium
References: 1 12 13 14 15 16 2 3 5 6 7 8 9

APO10.01 APO10.03 APO10.04 APO10.05 APO11.04 APO13.01 BAI03.05 BAI04.04 DSS01.03 DSS03.05 DSS05.02 DSS05.04 DSS05.05 DSS05.07 MEA01.01 MEA01.02 MEA01.03 MEA01.04 MEA01.05 MEA02.01

CCI-000366

164.312(a)(2)(ii)

4.3.2.6.7 4.3.3.3.9 4.3.3.5.8 4.3.4.4.7 4.4.2.1 4.4.2.2 4.4.2.4

SR 2.10 SR 2.11 SR 2.12 SR 2.8 SR 2.9 SR 6.1 SR 6.2 SR 7.1 SR 7.2

A.12.1.3 A.12.4.1 A.12.4.2 A.12.4.3 A.12.4.4 A.12.7.1 A.14.2.7 A.15.2.1 A.15.2.2 A.17.2.1

AU-4(1) CM-6(a)

DE.CM-1 DE.CM-3 DE.CM-7 ID.SC-4 PR.DS-4 PR.PT-1

SRG-OS-000480-GPOS-00227

RHEL-08-010561

CCE-80886-5

5.1.1.2

SV-230298r1017108_rule
Updated: about 1 month ago

Remediation Templates

include enable_rsyslog
class enable_rsyslog {
  service {'rsyslog':
    enable => true,
    ensure => 'running',
  }
}

service enable rsyslog

[customizations.services]
enabled = ["rsyslog"]

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-80886-5
  - DISA-STIG-RHEL-08-010561  - NIST-800-53-AU-4(1)
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_rsyslog_enabled
- name: Enable rsyslog Service - Enable service rsyslog
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Enable rsyslog Service - Enable Service rsyslog
    ansible.builtin.systemd:
      name: rsyslog
      enabled: true
      state: started
      masked: false
    when:
    - '"rsyslog" in ansible_facts.packages'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CCE-80886-5
  - DISA-STIG-RHEL-08-010561
  - NIST-800-53-AU-4(1)
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_rsyslog_enabled

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'rsyslog.service'
"$SYSTEMCTL_EXEC" start 'rsyslog.service'
"$SYSTEMCTL_EXEC" enable 'rsyslog.service'
else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Enable rsyslog Service

Description

Rationale

Remediation Templates

A Puppet Snippet

script:kickstart

OS Build Blueprint

An Ansible Snippet

A Shell Script