CIS Benchmark: Understand the journald vs. Rsyslog configuration conflict in RHEL 9 and 10

Updated

By default, Red Hat Enterprise Linux (RHEL) 9 and 10 installations run both the systemd-journald and rsyslog services simultaneously. However, starting with CIS Benchmark v2.0.0 for RHEL 9, logging requirements were restructured into mutually exclusive paths. This creates a friction point: the CIS rule ensure_journald_and_rsyslog_not_active_together triggers a FAIL on default systems because the benchmark expects exactly one logging system to be active.

Furthermore, users often encounter conflicting configuration mandates, such as section 6.2.2 requiring ForwardToSyslog=no for Journal, while section 6.2.3 requires ForwardToSyslog=yes for Rsyslog.

Configuration options

The benchmark does not strictly prohibit running both services, but it provides separate configuration sections for each, assuming you pick a primary method. The SSG CIS profiles contain Journal as the default solution. If your environment requires Rsyslog, you must customize your profile. Here is how the benchmark divides these requirements:

SectionPurposeSSG Profile Status
6.2.1General logging configurationIncluded
6.2.2Configure journaldIncluded (default)
6.2.3Configure rsyslogNot included (requires tailoring)

The profile selects rules checking Journal configuration by default. Rules checking Rsyslog configuration are available, but the profile does not select them. To use Rsyslog instead of Journal, customize rule selection by using a tailoring file.

Option A: Use Journal

If you choose Journal as your logging solution, disable Rsyslog:

sudo systemctl stop rsyslog
sudo systemctl disable rsyslog

Scan with the default CIS profile:

sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_server_l1 \
  --report rhel-cis-report.html \
  /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml

The default profile includes these rules for Journal configuration:

Rule IDCIS ControlDescription
ensure_journald_and_rsyslog_not_active_together6.2.1.4Ensures only one logging system is active
package_systemd-journal-remote_installed6.2.2.1.1Installs journal-remote package
service_systemd-journal-upload_enabled6.2.2.1.3Enables journal-upload service
socket_systemd-journal-remote_disabled6.2.2.1.4Disables journal-remote socket
journald_disable_forward_to_syslog6.2.2.2Disables forwarding to syslog
journald_compress6.2.2.3Configures journald compression
journald_storage6.2.2.4Configures journald persistent storage

Option B: Use Rsyslog

If your organization requires Rsyslog, create an XCCDF tailoring file that removes Journal-specific rules and adds Rsyslog rules.

Important: Rsyslog tailoring requires scap-security-guide 0.1.82 or later. Earlier versions lack certain rules in the datastream, which causes oscap to silently skip them.

Step 1: Generate the tailoring file

autotailor --output tailoring.xml \
  --new-profile-id xccdf_org.ssgproject.content_profile_cis_server_l1_rsyslog \
  --select package_rsyslog_installed \
  --select service_rsyslog_enabled \
  --select journald_forward_to_syslog \
  --select rsyslog_filecreatemode \
  --select rsyslog_remote_loghost \
  --select rsyslog_nolisten \
  --select ensure_logrotate_activated \
  --select package_logrotate_installed \
  --select timer_logrotate_enabled \
  --unselect journald_disable_forward_to_syslog \
  --unselect package_systemd-journal-remote_installed \
  --unselect service_systemd-journal-upload_enabled \
  --unselect socket_systemd-journal-remote_disabled \
  --unselect ensure_journald_and_rsyslog_not_active_together \
  /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml \
  xccdf_org.ssgproject.content_profile_cis_server_l1

Step 2: Scan using the tailored profile

sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_server_l1_rsyslog \
  --tailoring-file tailoring.xml \
  --report rhel-cis-rsyslog-report.html \
  /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml

Step 3: Remediate (optional)

sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_server_l1_rsyslog \
  --tailoring-file tailoring.xml \
  --remediate \
  /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml

Tailoring adds these Rsyslog rules:

Rule IDCIS ControlDescription
package_rsyslog_installed6.2.3.1Ensures rsyslog is installed
service_rsyslog_enabled6.2.3.2Ensures rsyslog service is active
journald_forward_to_syslog6.2.3.3Enables journald forwarding to rsyslog
rsyslog_filecreatemode6.2.3.4Configures log file creation mode
rsyslog_remote_loghost6.2.3.6Configures remote log host
rsyslog_nolisten6.2.3.7Disables remote log reception
ensure_logrotate_activated6.2.3.8Ensures logrotate is active
package_logrotate_installed6.2.3.8Ensures logrotate is installed
timer_logrotate_enabled6.2.3.8Ensures logrotate timer is enabled

Adapting for other profiles and RHEL versions

  • RHEL 9: Replace ssg-rhel10-ds.xml with ssg-rhel9-ds.xml
  • CIS Level 2: Replace cis_server_l1 with cis
  • Workstation: Replace cis_server_l1 with cis_workstation_l1 or cis_workstation_l2

Troubleshooting

Check which logging services are active:

systemctl is-active systemd-journald
systemctl is-active rsyslog

If both services return active, you continue to see CIS compliance failures. To resolve this, simply choose the logging architecture that fits your needs and follow the configuration steps outlined in the sections above.

Verify current Journal forwarding configuration:

grep -i ForwardToSyslog /etc/systemd/journald.conf /etc/systemd/journald.conf.d/*.conf 2>/dev/null

Additional resources

Category
Article Type