OpenVAPTLowHOST-LOG-001Logging and MonitoringServer
System Logging Not Persistent
Checks that system logs survive a reboot (rsyslog/syslog-ng running, or a persistent journal).
- Why It Matters
- Without persistent logs there is no evidence after an incident: no record of logins, sudo use, or service errors.
- How It Detects
- Checks whether rsyslog or syslog-ng is active, or whether /var/log/journal exists (systemd persistent journal).
- How to Fix
- Either install and enable rsyslog, or make the journal persistent: mkdir -p /var/log/journal && systemd-tmpfiles --create --prefix /var/log/journal && systemctl restart systemd-journald
- How to Verify
ls -d /var/log/journal or systemctl is-active rsyslog- CVSS v3.1 Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N- Control Category
- Logging and Monitoring: CIS Controls v8 8; NIST CSF 2.0 PR.PS, DE.CM
- Fix Effort
- Low
- CIS Controls v8 Safeguard
- 8.2
- NIST CSF 2.0 Subcategory
- PR.PS-04
- CWE
- CWE-778
- OWASP Top 10
- A09:2021
- NIST SP 800-53 Rev. 5
- AU-2, AU-9, AU-11
- Benchmark Topic
- Logging: persistent system logs (topic only, no benchmark text)
- References
- NIST SP 800-92, Guide to Computer Security Log Management
journald.conf(5)
Learn the theory behind this check: P16 Logging, Auditing and Time, A4 Building Your Own Check.
Source Code
The complete file that defines this check. Run it with openvapt scan --only HOST-LOG-001, or read it offline with openvapt explain HOST-LOG-001.
internal/checks/host/logging_time.go · Lines 1-80View on GitHub at This Commit
| 1 | package host |
| 2 | |
| 3 | import ( |
| 4 | "context" |
| 5 | |
| 6 | "github.com/openvapt/openvapt/internal/check" |
| 7 | "github.com/openvapt/openvapt/internal/checks/collect" |
| 8 | "github.com/openvapt/openvapt/internal/sys" |
| 9 | ) |
| 10 | |
| 11 | func init() { |
| 12 | check.Register(&check.Check{ |
| 13 | ID: "HOST-LOG-001", |
| 14 | Title: "System Logging Not Persistent", |
| 15 | Domain: check.DomainHost, |
| 16 | Severity: check.Low, |
| 17 | CVSS: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", |
| 18 | Summary: "Checks that system logs survive a reboot (rsyslog/syslog-ng running, or a persistent journal).", |
| 19 | Rationale: "Without persistent logs there is no evidence after an incident: no record of logins, sudo use, or service errors.", |
| 20 | Detection: "Checks whether rsyslog or syslog-ng is active, or whether /var/log/journal exists (systemd persistent journal).", |
| 21 | Fix: "Either install and enable rsyslog, or make the journal persistent: mkdir -p /var/log/journal && systemd-tmpfiles --create --prefix /var/log/journal && systemctl restart systemd-journald", |
| 22 | Verify: "ls -d /var/log/journal or systemctl is-active rsyslog", |
| 23 | Refs: []check.Ref{{Title: "NIST SP 800-92, Guide to Computer Security Log Management", URL: "https://csrc.nist.gov/pubs/sp/800/92/final"}, {Title: "journald.conf(5)", URL: "https://www.freedesktop.org/software/systemd/man/latest/journald.conf.html"}}, |
| 24 | Standards: check.Standards{CWE: []string{"CWE-778"}, OWASP: []string{"A09:2021"}, NIST: []string{"AU-2", "AU-9", "AU-11"}, CISTopic: "Logging: persistent system logs"}, |
| 25 | Run: func(ctx context.Context, s sys.System) []check.Result { |
| 26 | if u, ok := collect.ServiceActive(ctx, s, "rsyslog", "syslog-ng"); ok { |
| 27 | return []check.Result{check.PassR("logging", u+" is active")} |
| 28 | } |
| 29 | if st, err := s.Stat("/var/log/journal"); err == nil && st.IsDir { |
| 30 | return []check.Result{check.PassR("logging", "systemd journal is persistent (/var/log/journal)")} |
| 31 | } |
| 32 | return []check.Result{check.FailR("logging", "No syslog daemon active and the journal is not persistent")} |
| 33 | }, |
| 34 | }) |
| 35 | |
| 36 | check.Register(&check.Check{ |
| 37 | ID: "HOST-LOG-002", |
| 38 | Title: "Security Audit Daemon Not Running", |
| 39 | Domain: check.DomainHost, |
| 40 | Severity: check.Low, |
| 41 | CVSS: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", |
| 42 | Summary: "Checks whether the Linux audit daemon (auditd) is running.", |
| 43 | Rationale: "auditd records security-relevant events (changes to /etc/passwd, privilege use, file deletions) that ordinary logs miss, which incident responders rely on.", |
| 44 | Detection: "Asks systemd whether the auditd unit is active.", |
| 45 | Fix: "Install the audit package (apt install auditd, or dnf install audit), enable it (systemctl enable --now auditd) and load a rule set appropriate to your policy.", |
| 46 | Verify: "systemctl is-active auditd should print 'active'.", |
| 47 | Refs: []check.Ref{{Title: "auditd(8), Linux man-pages", URL: "https://man7.org/linux/man-pages/man8/auditd.8.html"}}, |
| 48 | Standards: check.Standards{CWE: []string{"CWE-778"}, OWASP: []string{"A09:2021"}, NIST: []string{"AU-2", "AU-12"}, CISTopic: "Logging and auditing: auditd"}, |
| 49 | Run: func(ctx context.Context, s sys.System) []check.Result { |
| 50 | if _, ok := collect.ServiceActive(ctx, s, "auditd"); ok { |
| 51 | return []check.Result{check.PassR("auditd", "auditd is active")} |
| 52 | } |
| 53 | return []check.Result{check.FailR("auditd", "auditd is not active")} |
| 54 | }, |
| 55 | }) |
| 56 | |
| 57 | check.Register(&check.Check{ |
| 58 | ID: "HOST-TIME-001", |
| 59 | Title: "Time Synchronisation Not Active", |
| 60 | Domain: check.DomainHost, |
| 61 | Severity: check.Low, |
| 62 | CVSS: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", |
| 63 | Summary: "Checks that the clock is kept in sync (chrony, ntpd or systemd-timesyncd).", |
| 64 | Rationale: "Accurate time is needed to correlate logs during an investigation, and TLS certificates and one-time-password codes fail when the clock drifts.", |
| 65 | Detection: "Asks systemd whether chronyd, chrony, ntpd, ntp or systemd-timesyncd is active.", |
| 66 | Fix: "Enable one time service, for example: systemctl enable --now systemd-timesyncd (or install chrony).", |
| 67 | Verify: "timedatectl should show 'System clock synchronized: yes'.", |
| 68 | Refs: []check.Ref{refNIST80053}, |
| 69 | // CWE-778 (Insufficient Logging) is the closest MITRE fit: no CWE |
| 70 | // names an unsynchronised clock, and records with a wrong time cannot |
| 71 | // be relied on to reconstruct events, which is the gap CWE-778 covers. |
| 72 | Standards: check.Standards{CWE: []string{"CWE-778"}, NIST: []string{"AU-8"}, CISTopic: "Time synchronisation"}, |
| 73 | Run: func(ctx context.Context, s sys.System) []check.Result { |
| 74 | if u, ok := collect.ServiceActive(ctx, s, "chronyd", "chrony", "systemd-timesyncd", "ntpd", "ntp", "ntpsec"); ok { |
| 75 | return []check.Result{check.PassR("time", u+" is active")} |
| 76 | } |
| 77 | return []check.Result{check.FailR("time", "No time synchronisation service is active")} |
| 78 | }, |
| 79 | }) |
| 80 | } |
Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.
Cite This Page
If this page helped your work, please cite it. The version and web address are filled in; the access date is today's date in your browser. Every other style, and when credit is required, is on How to Cite OpenVAPT.
APA 7
OpenVAPT. (2026). HOST-LOG-001 System Logging Not Persistent (Version 0.1.0-alpha.6). OpenVAPT Check Catalogue. Retrieved October 16, 2026, from https://openvapt.com/checks/HOST-LOG-001.html
In text: (OpenVAPT, 2026). Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
BibTeX
@misc{openvapt_host_log_001,
author = {{OpenVAPT}},
title = {{HOST-LOG-001 System Logging Not Persistent}},
year = {2026},
howpublished = {\url{https://openvapt.com/checks/HOST-LOG-001.html}},
note = {OpenVAPT Check Catalogue, version 0.1.0-alpha.6. Accessed 16 October 2026}
}
Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
Citing OpenVAPT does not mean OpenVAPT endorses, approves or has reviewed your work.