Forward the journal to rsyslog only when rsyslog is the chosen logger

Description

A Debian system should use one logging system: the systemd journal alone, or the journal feeding rsyslog, which then writes text files and forwards messages. The journald setting ForwardToSyslog= decides whether each message is also handed to a syslog daemon.

• When the rsyslog package is installed, ForwardToSyslog=yes is required, so that rsyslog receives every message.
• When it is not installed, ForwardToSyslog=no is required, since nothing reads the forwarded messages.

Debian 13 ships /usr/lib/systemd/journald.conf.d/syslog.conf with ForwardToSyslog=yes, even when no syslog daemon is installed. The fix writes /etc/systemd/journald.conf.d/syslog.conf, which replaces that vendor file. On Debian 12 the default is no.

Rationale

A mismatch either loses messages in the files and remote copies managed by rsyslog, or wastes resources on a socket nobody reads. Choosing one system keeps the log pipeline simple to review.

Impact

None known. The journal keeps every message in both cases.

Setting

Audit

1. Run dpkg-query -W -f='${Status}\n' rsyslog to know whether rsyslog is installed.
2. Run systemd-analyze cat-config systemd/journald.conf. The last ForwardToSyslog= must be yes if rsyslog is installed, and no (or absent) otherwise.

Automated: every check must pass. Scanners report each check by its id.

forward

Effective ForwardToSyslog= compared with the presence of rsyslog.

script: |
  v=$(systemd-analyze cat-config systemd/journald.conf 2>/dev/null | sed -n 's/^[[:space:]]*ForwardToSyslog=//p' | tail -n 1)
  case ${v:-no} in yes | true | on | 1) v=yes ;; *) v=no ;; esac
  case $(dpkg-query -W -f='${Status}' rsyslog 2>/dev/null) in
    *' installed') want=yes ;;
    *) want=no ;;
  esac
  echo "ForwardToSyslog=$v, expected $want"
  [ "$v" = "$want" ]

Remediation

Create /etc/systemd/journald.conf.d/syslog.conf with [Journal] and ForwardToSyslog=yes if rsyslog is installed, ForwardToSyslog=no otherwise, then run systemctl restart systemd-journald.

Rollback

Delete /etc/systemd/journald.conf.d/syslog.conf and run systemctl restart systemd-journald.

dropin

case $(dpkg-query -W -f='${Status}' rsyslog 2>/dev/null) in
  *' installed') v=yes ;;
  *) v=no ;;
esac
f=/etc/systemd/journald.conf.d/syslog.conf
mkdir -p /etc/systemd/journald.conf.d
cb_backup "$f"
printf '%s\n' '# Written by CIRSEC Baselines CB-DEB-AUDIT-002' '[Journal]' "ForwardToSyslog=$v" >"$f"
chmod 644 "$f"

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• journald.conf(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• rsyslogd(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-AUDIT-001 Keep the systemd journal running, persistent, compressed and bounded in size
• related CB-DEB-AUDIT-005 Run rsyslog and create its log files with restricted permissions

People and lifecycle