Forward the journal to rsyslog only when rsyslog is the chosen logger

Description

An Ubuntu system should use one logging system: the systemd journal alone, or the journal feeding rsyslog, which then writes text files and forwards messages. The journald setting ForwardToSyslog= decides whether each message is also handed to a syslog daemon.

• When the rsyslog package is installed, ForwardToSyslog=yes is required, so that rsyslog receives every message.
• When it is not installed, ForwardToSyslog=no is required, since nothing reads the forwarded messages.

Ubuntu Server installs rsyslog by default. On Ubuntu 20.04 and 22.04, journald is built with ForwardToSyslog=yes as its default (shown commented out in /etc/systemd/journald.conf); from 24.04 the built-in default is no and the rsyslog package ships /usr/lib/systemd/journald.conf.d/syslog.conf with ForwardToSyslog=yes. The check takes the built-in default into account when no file sets the value. The fix writes /etc/systemd/journald.conf.d/syslog.conf, which replaces the file shipped by rsyslog.

Rationale

A mismatch either loses messages in the files and remote copies managed by rsyslog, or wastes resources on a socket nobody reads. Choosing one system keeps the log pipeline simple to review.

Impact

None known. The journal keeps every message in both cases.

Setting

Audit

1. Run dpkg-query -W -f='${Status}\n' rsyslog to know whether rsyslog is installed.
2. Run systemd-analyze cat-config systemd/journald.conf. The last ForwardToSyslog= must be yes if rsyslog is installed, and no (or absent) otherwise.

Automated: every check must pass. Scanners report each check by its id.

forward

Effective ForwardToSyslog= compared with the presence of rsyslog.

script: |
  v=$(systemd-analyze cat-config systemd/journald.conf 2>/dev/null | sed -n 's/^[[:space:]]*ForwardToSyslog=//p' | tail -n 1)
  # unset: the build default, shown commented out in journald.conf (yes on 20.04 and 22.04)
  [ -n "$v" ] || v=$(sed -n 's/^#ForwardToSyslog=//p' /etc/systemd/journald.conf 2>/dev/null | head -n 1)
  case ${v:-no} in yes | true | on | 1) v=yes ;; *) v=no ;; esac
  case $(dpkg-query -W -f='${Status}' rsyslog 2>/dev/null) in
    *' installed') want=yes ;;
    *) want=no ;;
  esac
  echo "ForwardToSyslog=$v, expected $want"
  [ "$v" = "$want" ]

Remediation

Create /etc/systemd/journald.conf.d/syslog.conf with [Journal] and ForwardToSyslog=yes if rsyslog is installed, ForwardToSyslog=no otherwise, then run systemctl restart systemd-journald.

Rollback

Delete /etc/systemd/journald.conf.d/syslog.conf and run systemctl restart systemd-journald.

dropin

case $(dpkg-query -W -f='${Status}' rsyslog 2>/dev/null) in
  *' installed') v=yes ;;
  *) v=no ;;
esac
f=/etc/systemd/journald.conf.d/syslog.conf
mkdir -p /etc/systemd/journald.conf.d
cb_backup "$f"
printf '%s\n' '# Written by CIRSEC Baselines CB-UBU-AUDIT-002' '[Journal]' "ForwardToSyslog=$v" >"$f"
chmod 644 "$f"

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• journald.conf(5), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• rsyslogd(8), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-UBU-AUDIT-001 Keep the systemd journal running, persistent, compressed and bounded in size
• related CB-UBU-AUDIT-005 Run rsyslog and create its log files with restricted permissions

People and lifecycle