Ensure journald is configured to write log files to persistent disk

Classification:

compliance

Framework:

Control:

Description

The journald system may store log files in volatile memory or locally on disk. If the logs are only stored in volatile memory they will we lost upon reboot.

Rationale

Log files contain valuable data and need to be persistent to aid in possible investigations.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if [ -e "/etc/systemd/journald.conf" ] ; then
 
 LC\_ALL=C sed -i "/^\s\*Storage\s\*=\s\*/d" "/etc/systemd/journald.conf"
else
 touch "/etc/systemd/journald.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/systemd/journald.conf"

cp "/etc/systemd/journald.conf" "/etc/systemd/journald.conf.bak"
# Insert before the line matching the regex '^#\s\*Storage'.
line\_number="$(LC\_ALL=C grep -n "^#\s\*Storage" "/etc/systemd/journald.conf.bak" | LC\_ALL=C sed 's/:.\*//g')"
if [ -z "$line\_number" ]; then
 # There was no match of '^#\s\*Storage', insert at
 # the end of the file.
 printf '%s\n' "Storage='persistent'" >> "/etc/systemd/journald.conf"
else
 head -n "$(( line\_number - 1 ))" "/etc/systemd/journald.conf.bak" > "/etc/systemd/journald.conf"
 printf '%s\n' "Storage='persistent'" >> "/etc/systemd/journald.conf"
 tail -n "+$(( line\_number ))" "/etc/systemd/journald.conf.bak" >> "/etc/systemd/journald.conf"
fi
# Clean up after ourselves.
rm "/etc/systemd/journald.conf.bak"

else
 >&2 echo 'Remediation is not applicable, nothing was done'
fi

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: Setting shell-quoted shell-style assignment of 'Storage' to 'persistent' in
 '/etc/systemd/journald.conf'
 block:

 - name: Check for duplicate values
 lineinfile:
 path: /etc/systemd/journald.conf
 create: false
 regexp: ^\s\*Storage=
 state: absent
 check\_mode: true
 changed\_when: false
 register: dupes

 - name: Deduplicate values from /etc/systemd/journald.conf
 lineinfile:
 path: /etc/systemd/journald.conf
 create: false
 regexp: ^\s\*Storage=
 state: absent
 when: dupes.found is defined and dupes.found > 1

 - name: Insert correct line to /etc/systemd/journald.conf
 lineinfile:
 path: /etc/systemd/journald.conf
 create: true
 regexp: ^\s\*Storage=
 line: Storage="persistent"
 state: present
 insertbefore: ^# Storage
 validate: /usr/bin/bash -n %s
 when: ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - journald\_storage
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed
 - restrict\_strategy