RHEL 9 must use a separate file system for /var/log.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-257846	RHEL-09-231025	SV-257846r1044922_rule		Low

Description

Placing "/var/log" in its own partition enables better separation between log files and other files in "/var/".

STIG	Date
Red Hat Enterprise Linux 9 Security Technical Implementation Guide	2024-12-04

Details

Check Text (C-61587r1044921_chk)

Verify that a separate file system/partition has been created for "/var/log" with the following command:

$ mount | grep /var/log

/dev/mapper/rhel-var_log on /var/log type xfs (rw,nosuid,nodev,noexec,relatime,seclabel,attr2,inode64,logbufs=8,logbsize=32k)
Note: Options displayed for mount may differ.

If a separate entry for "/var/log" is not in use, this is a finding.

Fix Text (F-61511r925524_fix)

Migrate the "/var/log" path onto a separate file system.