Review which messages rsyslog writes and where

Description

rsyslog sorts messages into files by facility and priority with the rules in /etc/rsyslog.conf and /etc/rsyslog.d/*.conf. Debian writes, among others, /var/log/syslog, /var/log/auth.log (authentication), /var/log/kern.log and /var/log/user.log. The site must check that the messages it needs (authentication, privilege use, kernel, critical errors of its services) end up in files that are kept long enough and monitored.

Rationale

A message that is not written anywhere cannot be investigated. The defaults are generic; only the administrator knows which services and events matter.

Impact

None known.

Applies when

Detected: when: rsyslog is installed A scanner reports the control not applicable when one is false.

Only when rsyslog is installed.

Audit

1. Read the rules with grep -Ev '^\s*(#|$)' /etc/rsyslog.conf /etc/rsyslog.d/*.conf.
2. Check that auth,authpriv.* goes to a dedicated file (/var/log/auth.log on Debian), that kern.* and *.emerg are logged, and that the messages of the services this system runs reach a file or the remote log server.
3. Check that each file is rotated (CB-DEB-AUDIT-007) and kept as long as the site policy requires.

Remediation

Add the missing rules in a file of /etc/rsyslog.d/, for example:

auth,authpriv.*   /var/log/auth.log
kern.*            -/var/log/kern.log
*.emerg           :omusrmsg:*

Then run systemctl restart rsyslog.

Rollback

Remove the added file and run systemctl restart rsyslog.

References

• rsyslog.conf(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R71) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-AUDIT-005 Run rsyslog and create its log files with restricted permissions

People and lifecycle