5.4 Ensure that new entries are appended to the end of the log file

Information

By default, new log entries will overwrite old entries after a restart of the mongod or Mongols service. Enabling the systemLog.logAppend setting causes new entries to be appended to the end of the log file rather than overwriting the existing content of the log when the mongos or mongod instance restarts.

Rationale:

Allowing old entries to be overwritten by new entries instead of appending new entries to the end of the log may destroy old log data that is needed for a variety of purposes.

Solution

Set

'systemLog:
logAppend: true'

to true in the /etc/mongod.conf file.

See Also

https://workbench.cisecurity.org/files/3463

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-11, CSCv7|6.4

Plugin: Unix

Control ID: 5e944d610f2726428b31b95a2128dc52607f067e69d40b44bac95834188b2b29