Ensure journald is configured to send logs to rsyslog
Sets ForwardToSyslog=no so journald does not duplicate every record into syslog, leaving a single deliberate logging pipeline.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
This domain is partially covered by Pavois today, see coverage.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
When journald forwards everything to syslog as well, records are written twice, wasting disk and I/O and creating divergent copies. The hardened baseline keeps one authoritative pipeline; centralized/remote shipping should be configured explicitly (e.g. an rsyslog @@remote rule) rather than relying on blanket forwarding. Storing log data on a remote host also protects integrity: if an attacker gains root locally, they can tamper with or delete local logs, so a single, intentionally-configured forwarding path is easier to secure and reason about.
What Pavois checks
Pavois greps /etc/systemd/journald.conf and the journald.conf.d/ drop-ins for an active ForwardToSyslog=no. Since journald merges drop-ins over the base file, scanning both yields the effective value, a drop-in setting no correctly overrides a base yes.
only_if { !service('rsyslog').running? && !service('syslog-ng').running? }
describe command('systemd-analyze cat-config systemd/journald.conf 2>/dev/null | grep -iE "^[[:space:]]*ForwardToSyslog[[:space:]]*=" | tail -1') do
its('stdout') { should match(/=\s*no/i) }
endHow to verify it is applied
Run grep -riE '^\s*ForwardToSyslog\s*=\s*no' /etc/systemd/journald.conf /etc/systemd/journald.conf.d/. Expected: at least one matching line. Apply with systemctl restart systemd-journald.
Inspect & investigate
Check journald state with journalctl -u systemd-journald and systemctl status systemd-journald. If syslog is in use, confirm whether records are being duplicated by comparing journalctl output against /var/log/syslog (Debian/Ubuntu) or /var/log/messages (RHEL). Active config: /etc/systemd/journald.conf and /etc/systemd/journald.conf.d/*.conf.
Remediation
pavois harden apply writes the file resource /etc/systemd/journald.conf.d/99-Pavois.conf (root:root, 0644) containing [Journal] with Compress=yes, ForwardToSyslog=no and Storage=persistent, so this single drop-in satisfies the compress, forward and storage journald rules at once. Reload journald afterwards (systemctl restart systemd-journald) for it to take effect.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| content | [Journal] ForwardToSyslog=no |
|---|---|
| group | root |
| mode | 0644 |
| owner | root |
| path | /etc/systemd/journald.conf.d/99-pavois-forward.conf |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling forwarding is low-risk, but do not disable it blindly if syslog is your only path to a central SIEM, you would stop shipping logs off-box. Precaution: before applying, confirm how logs reach your collector; if it is via journald→syslog forwarding, set up explicit remote rsyslog/systemd-journal-upload first, then turn forwarding off. The drop-in is overwritten on each apply, so any manual [Journal] tuning in the same file must be folded into Pavois's content. Restarting journald briefly pauses journal writes.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.3.3, 6.2.2.2, 6.2.1.1.4 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.