UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The Ubuntu operating system must be configured to preserve log records from failure events.


Overview

Finding ID Version Rule ID IA Controls Severity
V-219160 UBTU-18-010022 SV-219160r610963_rule Medium
Description
Failure to a known state can address safety or security in accordance with the mission/business needs of the organization. Failure to a known secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system. Preserving operating system state information helps to facilitate operating system restart and return to the operational mode of the organization with least disruption to mission/business processes.
STIG Date
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide 2021-11-29

Details

Check Text ( C-20885r304808_chk )
Verify the log service is configured to collect system failure events.

Check that the log service is installed properly with the following command:

# dpkg -l | grep rsyslog

ii rsyslog 8.32.0-1ubuntu4 amd64 reliable system and kernel logging daemon

If the "rsyslog" package is not installed, this is a finding.

Check that the log service is enabled with the following command:

# sudo systemctl is-enabled rsyslog

enabled

If the command above returns "disabled", this is a finding.

Check that the log service is properly running and active on the system with the following command:

# systemctl is-active rsyslog

active

If the command above returns "inactive", this is a finding.
Fix Text (F-20884r304809_fix)
Configure the log service to collect failure events.

Install the log service (if the log service is not already installed) with the following command:

# sudo apt-get install rsyslog

Enable the log service with the following command:

# sudo systemctl enable rsyslog

Restart the log service with the following command:

# sudo systemctl restart rsyslog