cis-ubuntu2004-v300-6-2-1-3

name	cis-ubuntu2004-v300-6-2-1-3
description	Ensure journald log file rotation is configured
category	cis-logging
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","journald"]
cis_id	6.2.1.3
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

6.2.1.3 Ensure journald log file rotation is configured (Manual)

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

Journald includes the capability of rotating log files regularly to avoid filling up the system with logs or making the logs unmanageably large. The file /etc/systemd/journald.conf is the configuration file used to specify how logs generated by Journald should be rotated.

Rationale

By keeping the log files smaller and more manageable, a system administrator can easily archive these files to another system and spend less time looking through inordinately large log files.

Audit Procedure

Command Line

Review the systemd-journald configuration. Verify logs are rotated according to site policy. The specific parameters for log rotation are:

Run the following script and review the output to ensure logs are rotated according to site policy:

#!/usr/bin/env bash
{
    a_output=() a_output2=() l_analyze_cmd="$(readlink -f /bin/systemd-analyze)"
    l_systemd_config_file="systemd/journald.conf"
    a_parameters=("SystemMaxUse=^.+$" "SystemKeepFree=^.+$" "RuntimeMaxUse=^.+$" "RuntimeKeepFree=^.+$"
    "MaxFileSec=^.+$")
    # ... (full audit script from benchmark)
}

Expected Result

Review the output to verify log rotation parameters are configured according to site policy.

Remediation

Command Line

Edit /etc/systemd/journald.conf or a file ending in .conf the /etc/systemd/journald.conf.d/ directory. Set the following parameters in the [Journal] section to ensure logs are rotated according to site policy. The settings should be carefully understood as there are specific edge cases and prioritization of parameters.

Example Configuration:

[Journal]
SystemMaxUse=1G
SystemKeepFree=500M
RuntimeMaxUse=200M
=M
=month