Ensure journald is configured to compress large log files
Sets Compress=yes for systemd-journald so large journal objects are compressed on disk.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
This domain is partially covered by Pavois today, see coverage.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Uncompressed journals can grow large enough to fill the log partition. Once the partition is full, journald drops new records and valuable logging information, including evidence of an attack in progress, is lost. Compression stretches the retained history within the same disk budget.
What Pavois checks
Pavois greps /etc/systemd/journald.conf and the journald.conf.d/ drop-in directory for an active Compress=yes. Because journald merges drop-ins over the main file, scanning both reflects the effective setting: a base file saying no overridden by a drop-in saying yes is correctly seen as enabled.
describe command('grep -rqiE \'^[[:space:]]*Compress[[:space:]]*=[[:space:]]*yes\b\' /etc/systemd/journald.conf /etc/systemd/journald.conf.d/ 2>/dev/null && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run systemctl show systemd-journald is not authoritative for this; instead check the resolved config with grep -riE '^\s*Compress\s*=\s*yes' /etc/systemd/journald.conf /etc/systemd/journald.conf.d/. Expected: at least one matching Compress=yes. Apply changes with systemctl restart systemd-journald.
Inspect & investigate
Inspect journald's own state and usage with journalctl --disk-usage and journalctl -u systemd-journald. Configuration reload/restart events appear via systemctl status systemd-journald. The active config files are /etc/systemd/journald.conf and /etc/systemd/journald.conf.d/*.conf.
Remediation
No automated remediation is shipped for this slug (remediation is empty): apply manually. Add Compress=yes under [Journal] in a drop-in such as /etc/systemd/journald.conf.d/99-Pavois.conf, then run systemctl restart systemd-journald. (The related journald-forwardtosyslog rule writes that same drop-in via pavois harden apply.)
Pavois applies this with its own harden engine, the plan below, not a shell script:
| content | [Journal] Compress=yes |
|---|---|
| group | root |
| mode | 0644 |
| owner | root |
| path | /etc/systemd/journald.conf.d/99-pavois-compress.conf |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Misconfiguration risks a full log partition and lost audit evidence; the control itself is low-risk to enable. Precautions before applying: restarting systemd-journald is generally safe but briefly interrupts journal writes, schedule it during a quiet window on busy log servers. Compression only applies to objects above journald's internal threshold, so do not expect existing small entries to shrink.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.2.3, 6.2.2.3, 6.2.1.1.6 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.