Ensure logrotate is Installed
Ensures the logrotate package is installed so log files are rotated, compressed and pruned on a schedule.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The logrotate package rotates, compresses and prunes log files on a schedule. Without it, logs in /var/log grow without bound and can fill the filesystem, leading to service outages, lost audit trails (logging stops when the disk is full) and difficult forensic analysis. Controlled rotation keeps logs available for the required retention window while preventing disk exhaustion.
What Pavois checks
Pavois checks the package database via the InSpec package('logrotate') resource and asserts should be_installed, resolving through dpkg on Debian/Ubuntu and rpm on RHEL-family. This reflects the effective package state rather than assuming rotation works because /etc/logrotate.conf exists, the config files can remain after the binary is removed, in which case no rotation ever runs.
describe package('logrotate') do
it { should be_installed }
endHow to verify it is applied
Debian/Ubuntu: dpkg -s logrotate | grep Status should print Status: install ok installed. RHEL: rpm -q logrotate returns the version. Confirm scheduling is active with systemctl status logrotate.timer (or the cron job in /etc/cron.daily/logrotate).
Inspect & investigate
Rotation runs are logged via the systemd timer/service: journalctl -u logrotate.service. The package install itself is in dpkg.log (/var/log/dpkg.log) or dnf history. A logrotate --debug /etc/logrotate.conf dry-run shows exactly what would be rotated.
Remediation
Pavois's harden plan declares a package resource for logrotate with action install; pavois harden apply installs it through the native package manager (apt/dnf). The package ships default rotation rules and the systemd timer, so basic scheduled rotation works immediately. Tune /etc/logrotate.conf and /etc/logrotate.d/* to match your retention policy.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | logrotate |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without logrotate, log files can grow until /var/log fills the disk, stopping logging and potentially crashing services; conversely, overly aggressive rules can delete logs still needed for audits. Precautions: installing the package is non-disruptive. Before relying on it, verify retention settings meet your compliance window (PCI-DSS/CIS typically require keeping logs for a defined period) and ensure /var/log has adequate free space and a working timer.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R71 | direct | 2.0 | high |
| CIS | 10.5.1 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 10.5.1 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.