Ensure journald is configured to write log files to persistent disk
Sets Storage=persistent so journald writes logs to /var/log/journal and they survive reboots instead of living only in volatile memory.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
This domain is partially covered by Pavois today, see coverage.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
With the default auto/volatile behavior journals can live only in /run and vanish on reboot. Logs hold valuable forensic data: if they are not persistent, a crash, power loss or an attacker-triggered reboot wipes the evidence needed to investigate an incident.
What Pavois checks
Pavois greps /etc/systemd/journald.conf and the journald.conf.d/ drop-ins for an active Storage=persistent. journald merges drop-ins over the base file, so scanning both gives the effective storage mode, a drop-in setting persistent correctly overrides a base auto/volatile.
describe command('grep -rqiE \'^[[:space:]]*Storage[[:space:]]*=[[:space:]]*persistent\b\' /etc/systemd/journald.conf /etc/systemd/journald.conf.d/ 2>/dev/null && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -riE '^\s*Storage\s*=\s*persistent' /etc/systemd/journald.conf /etc/systemd/journald.conf.d/ and confirm /var/log/journal/ exists and holds data (journalctl --disk-usage). Expected: a matching Storage=persistent line and a populated /var/log/journal.
Inspect & investigate
Confirm persistence with journalctl --disk-usage and list boots with journalctl --list-boots, multiple past boots prove logs survive reboots. The journal directory is /var/log/journal/; config lives in /etc/systemd/journald.conf and /etc/systemd/journald.conf.d/*.conf. Restart events show via systemctl status systemd-journald.
Remediation
No automated remediation is shipped for this slug (remediation is empty): apply manually. Add Storage=persistent under [Journal] in /etc/systemd/journald.conf.d/99-Pavois.conf, then mkdir -p /var/log/journal and systemctl restart systemd-journald. (The journald-forwardtosyslog rule writes that same drop-in, including Storage=persistent, via pavois harden apply.)
Pavois applies this with its own harden engine, the plan below, not a shell script:
| content | [Journal] Storage=persistent |
|---|---|
| group | root |
| mode | 0644 |
| owner | root |
| path | /etc/systemd/journald.conf.d/99-pavois-storage.conf |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Volatile-only logs mean lost forensic evidence after any reboot. Enabling persistence is low-risk but consumes disk under /var/log/journal. Precautions before applying: ensure /var (or its own partition) has headroom and cap growth with SystemMaxUse=/SystemKeepFree= to avoid filling the partition; create /var/log/journal before restarting so journald migrates immediately. Restarting journald briefly pauses journal writes.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.2.4, 6.2.2.4, 6.2.1.1.5 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.