Give each exposed service its own activity log

Description

Each service that matters to the system (web server, reverse proxy, database, mail, VPN, application) should write its activity (requests, connections, errors, administrative actions) to a log of its own: a dedicated file, a journal namespace or at least its own syslog identifier and facility, readable only by the service account and administrators.

Rationale

Dedicated logs make investigation of one service practical, allow a retention adapted to its sensitivity, and limit who can read data that only concerns that service.

Impact

More files to rotate and forward.

Audit

1. List the services that listen on the network with ss -tulpn and the main services of the system.
2. For each one, find where it logs (its configuration, journalctl -u <unit>) and check that its activity is recorded, kept for the required time, rotated and readable only by the service and administrators.

Remediation

Configure each service to log to its own file (for example the access and error logs of a web server) or journal namespace (LogNamespace= in the unit), add a logrotate file for it, and include it in the logs sent to the log server.

Rollback

Revert the service logging configuration.

References

• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R72) ANSSI, guide, accessed 2026-10-18
• journald.conf(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle