Ensure auditd Collects records for events that affect "/var/log/journal"
Installs an auditd watch keyed systemd_journal on /var/log/journal so every access to the systemd journal store is recorded.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Once attackers gain access, they often try to establish persistence and cover their tracks by tampering with logs. The systemd journal under /var/log/journal holds the primary record of system and authentication activity; watching it produces a tamper-evidence trail usable for forensics. Without this watch, an intruder could delete or alter journal files silently, erasing the evidence of their intrusion.
What Pavois checks
Pavois runs auditctl -l and checks the live kernel ruleset for a rule keyed systemd_journal. A rule file present on disk is meaningless if it was never loaded (augenrules not run, syntax error, service not reloaded); only the live ruleset from auditctl -l proves /var/log/journal is actually being watched right now.
describe command('auditctl -l') do
its('stdout') { should match(/(-k +|key=)systemd_journal\b/) }
end
describe command("grep -rhwsE 'systemd_journal' /etc/audit/rules.d/*.rules /etc/audit/audit.rules 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run auditctl -l | grep systemd_journal. Expect a watch such as -w /var/log/journal -p wa -k systemd_journal. Touch a file under the path and confirm an event is recorded.
Inspect & investigate
Events land in /var/log/audit/audit.log. Since ausearch can falsely report "no matches", grep the raw log: grep 'key="systemd_journal"' /var/log/audit/audit.log. Service state: systemctl status auditd.
Remediation
pavois harden apply uses the audit_ruleset resource to write a Pavois-managed rules file under /etc/audit/rules.d/ with -w /var/log/journal -p wa -k systemd_journal, then reloads auditd to load it into the kernel. A reboot is flagged because a hardened host locks the ruleset immutable (-e 2), so the new watch applies cleanly after restart.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| reboot_required | true |
|---|---|
| resource | audit_ruleset |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Low impact: a single passive watch. Precautions: writes to the journal are frequent, so this watch generates volume, ensure audit_backlog_limit is large enough and that /var/log/audit has room. If auditd's failure policy is halt/single, a full audit partition can wedge the host; size the partition and monitor it before locking the ruleset with -e 2.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| DISA STIG | UBTU-22-654190, UBTU-24-300029 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.