A system logging daemon is active
Ensures a system logging daemon, rsyslog or syslog-ng, is installed and actively running.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
This domain is partially covered by Pavois today, see coverage.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
A running syslog daemon (rsyslog or syslog-ng) is required to capture, persist and forward system and security events. Without an active logging daemon, evidence of intrusions, service failures and policy violations is lost, defeating incident response, forensics and compliance auditing. Centralized logging also enables off-host retention so an attacker cannot simply erase local traces.
What Pavois checks
Pavois checks the effective service state: it iterates over rsyslog and syslog-ng and accepts the rule as soon as systemctl is-active reports one of them running. Querying systemd reflects whether the daemon is truly up right now, a package being installed or a unit file present says nothing about a service that failed to start or was masked.
describe command('for s in rsyslog syslog-ng; do systemctl is-active --quiet "$s" && { echo ok; exit 0; }; done; echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
systemctl is-active rsyslog(orsyslog-ng) should returnactive.systemctl status rsyslogshould showrunning.logger -t test 'Pavois check'; tail -n1 /var/log/syslog(Debian/Ubuntu) or/var/log/messages(RHEL) should show the test line.
Inspect & investigate
systemctl status rsyslog/systemctl status syslog-ngfor daemon health.journalctl -u rsyslogfor the daemon's own start/stop and error events./var/log/syslogor/var/log/messagesare the files the daemon itself produces.
Remediation
Pavois's harden plan uses a choose resource: it installs and enables a logging daemon, defaulting to rsyslog (package rsyslog, service rsyslog), with syslog-ng as an alternative. It installs the package, then enables and starts the service so logging is active immediately and on boot. Apply with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| default | rsyslog |
|---|---|
| options | rsyslog: package: rsyslog, service: rsyslog, syslog-ng: package: syslog-ng, service: syslog-ng |
| resource | choose |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Low risk, adding a syslog daemon is non-disruptive. Caution: do not run both rsyslog and syslog-ng simultaneously, as they compete for the same sockets and inputs; pick one. On minimal/container images that rely solely on the systemd journal, installing rsyslog increases disk usage from /var/log, ensure log rotation is configured.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R71 | direct | 2.0 | high |
| CIS | 6.1.3.2, 6.2.2.2 | direct | per OS, see the benchmark table | high |
| DISA STIG | UBTU-22-652010, UBTU-24-100200 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.