Send system logs to a remote log server

Description

A copy of the logs must leave the system as they are produced, to a log server or a central collection platform the system cannot modify. On Debian, two ways fit the chosen logging system:

• with the journal alone, systemd-journal-upload (package systemd-journal-remote) sends the journal over HTTPS to a systemd-journal-remote server;
• with rsyslog, an omfwd action sends messages over TCP, preferably with TLS (CB-DEB-AUDIT-009).

Rationale

Remote logs survive the compromise or loss of the system and are the reference when local logs have been altered. They also allow correlating events across systems.

Impact

Requires a log server and network flows to it. Messages are queued when the server is unreachable; size the queue so a long outage does not fill the disk.

Audit

1. With the journal alone: run systemctl is-active systemd-journal-upload and check URL= in systemd-analyze cat-config systemd/journal-upload.conf.
2. With rsyslog: look for an action(type="omfwd" target=...) or @@host line with grep -Er 'omfwd|^\s*[^#].*@@?' /etc/rsyslog.conf /etc/rsyslog.d/.
3. Confirm on the log server that recent messages from this system have arrived.

Remediation

1. With the journal alone: install systemd-journal-remote, set URL=https://<server>:19532 and the client certificate in /etc/systemd/journal-upload.conf.d/, then run systemctl enable --now systemd-journal-upload.
2. With rsyslog: add to /etc/rsyslog.d/60-remote.conf:

   *.* action(type="omfwd" target="<server>" port="6514" protocol="tcp"
              StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name"
              queue.type="LinkedList" queue.filename="fwd" queue.saveOnShutdown="on"
              action.resumeRetryCount="-1")
   

   then run systemctl restart rsyslog.

Rollback

Disable systemd-journal-upload, or remove the forwarding file and restart rsyslog.

References

• systemd-journal-upload.service(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• rsyslog.conf(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R71) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-AUDIT-009 Encrypt and authenticate the rsyslog connection to the log server

People and lifecycle