Keep the systemd journal running, persistent, compressed and bounded in size

Description

systemd-journald collects the messages of the kernel, of services and of programs that use syslog. Its settings live in /etc/systemd/journald.conf and drop-in files in /etc/systemd/journald.conf.d/. This control requires:

• the systemd-journald service to run;
• Storage=persistent, so the journal is written to /var/log/journal/ and survives reboots;
• Compress=yes (the default), so large entries are compressed;
• an explicit size budget: SystemMaxUse={{ max_use }} and SystemKeepFree={{ keep_free }}. journald removes the oldest archived files to stay within these limits.

On Debian 12 and 13 the default is Storage=auto and /var/log/journal/ exists, so the journal is already persistent; the control asks for an explicit setting so that removing the directory does not silently switch to memory-only logging.

Rationale

Logs are the first source when investigating an incident. A journal kept only in memory is lost at every reboot, which is also what an intruder triggers to erase traces. An explicit size budget makes rotation predictable and keeps the journal from filling the file system.

Impact

Journal files use up to {{ max_use }} on the file system holding /var/log. The oldest entries are removed when the budget is reached; keep a remote copy (CB-DEB-AUDIT-008) when a longer history is required.

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Run systemctl is-active systemd-journald. It must print active.
2. Run systemd-analyze cat-config systemd/journald.conf. The last value of each setting must be Storage=persistent, Compress=yes (or no Compress= line), SystemMaxUse={{ max_use }} and SystemKeepFree={{ keep_free }}.

Automated: every check must pass. Scanners report each check by its id.

active

State of the systemd-journald service.

script: |
  o=$(systemctl is-active systemd-journald 2>/dev/null)
  echo "systemd-journald: ${o:-unknown}"
  [ "$o" = active ]

storage

Effective Storage= of journald.

script: |
  v=$(systemd-analyze cat-config systemd/journald.conf 2>/dev/null | sed -n 's/^[[:space:]]*Storage=//p' | tail -n 1)
  echo "Storage=${v:-auto (default)}"
  [ "$v" = persistent ]

compress

Effective Compress= of journald.

script: |
  v=$(systemd-analyze cat-config systemd/journald.conf 2>/dev/null | sed -n 's/^[[:space:]]*Compress=//p' | tail -n 1)
  echo "Compress=${v:-yes (default)}"
  case ${v:-yes} in yes | true | on | 1) exit 0 ;; esac
  exit 1

size

Effective SystemMaxUse= and SystemKeepFree= of journald.

script: |
  c=$(systemd-analyze cat-config systemd/journald.conf 2>/dev/null)
  m=$(printf '%s\n' "$c" | sed -n 's/^[[:space:]]*SystemMaxUse=//p' | tail -n 1)
  k=$(printf '%s\n' "$c" | sed -n 's/^[[:space:]]*SystemKeepFree=//p' | tail -n 1)
  echo "SystemMaxUse=${m:-default} SystemKeepFree=${k:-default}"
  [ "$m" = "$CB_MAX_USE" ] && [ "$k" = "$CB_KEEP_FREE" ]

Remediation

1. Create /etc/systemd/journald.conf.d/60-cirsec.conf with:

   [Journal]
   Storage=persistent
   Compress=yes
   SystemMaxUse={{ max_use }}
   SystemKeepFree={{ keep_free }}
   

2. Run systemctl restart systemd-journald.

Rollback

Delete /etc/systemd/journald.conf.d/60-cirsec.conf and run systemctl restart systemd-journald.

dropin

f=/etc/systemd/journald.conf.d/60-cirsec.conf
mkdir -p /etc/systemd/journald.conf.d
cb_backup "$f"
printf '%s\n' '# Written by CIRSEC Baselines CB-DEB-AUDIT-001' '[Journal]' 'Storage=persistent' 'Compress=yes' \
  "SystemMaxUse=$CB_MAX_USE" "SystemKeepFree=$CB_KEEP_FREE" >"$f"
chmod 644 "$f"
systemctl start systemd-journald

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• journald.conf(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R71) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-AUDIT-002 Forward the journal to rsyslog only when rsyslog is the chosen logger
• related CB-DEB-AUDIT-008 Send system logs to a remote log server

People and lifecycle