4.2.1.1 Ensure rsyslog or syslog-ng is installed

Information

The rsyslog and syslog-ng software are recommended replacements to the original syslogd daemon which provide improvements over syslogd , such as connection-oriented (i.e. TCP) transmission of logs, the option to log to database formats, and the encryption of log data en route to a central logging server.

Rationale:

The security enhancements of rsyslog and syslog-ng such as connection-oriented (i.e. TCP) transmission of logs, the option to log to database formats, and the encryption of log data en route to a central logging server) justify installing and configuring the package.

Solution

Install rsyslog or syslog-ng using one of the following commands:

# yum install rsyslog
# yum install syslog-ng

Notes:

The syslog-ng package requires the EPEL7 and Optional repositories be enabled. See https://czanik.blogs.balabit.com/2015/09/installing-syslog-ng-ose-3-7-1-on-rhel6-and-centos6/ for more information.

See Also

https://workbench.cisecurity.org/files/2688

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7(5)

Plugin: Unix

Control ID: 6be23cd243fd74ed9b87a8f4b53e445c0c5b76f5b986b73580d53c16c8f12670