Linux Security Techniques - 1.

0 Monitoring and Auditing Security

============================================================

Filename: techskills-linuxsecurity-1-2-managing_logs_with_journald
Title: Managing Logs with journald
Subtitle: Linux Security Techniques

1.2 Managing Logs with journald

Isn't this the same as syslog?

systemd Journal
Designed as a replacement for SysLog
Ubuntu and RHEL run both simultaneously
Stores logs as a secured binary so they can not be altered

So how do we interact with journald if the logs are in a binary format?

journalctl
See most recent entries
journalctl -n <#>
Defaults to 10 if no number specified
Monitor most recent entries
journalctl -f
Equivalent to tail -f
Can be filtered by priority
journalctl -p err
Filtering for time
journalctl --since="2016-11-29 00:00:00" --until="2016-11-29 23:59:59"
Example troubleshooting a single service
journalctl -xau firewalld
x - Display explanation
a - Extended output
u - Filter to a particular unit
f - Follow the log file (continual output)

Where are the journald logs stored?

Stored in RAM by default and not retained after a reboot

Persistent storage can be enabled
1. sudo mkdir -p /var/log/journal/
2. sudo systemctl restart systemd-journald
or
1. sudo vi /etc/systemd/journald.conf
2. Storage=persistent
3. sudo systemctl restart systemd-journald

Who is allowed to access the logs?

Can only be accessed by administrators

usermod -a -G adm <username>

Is there a journald equivalent to rsyslog?

systemd-journal-remote
Still a work-in-progress
Will ultimately replace rsyslog
Steps to enable (Sending Server)
1. yum install systemd-journal-remote
2. vi /etc/systemd/journal-upload.conf
[Upload]
URL=http://<ip>:<port>
3. systemctl enable --now systemd-journal-upload
Steps to enable (Receiving Server)
1. yum install systemd-journal-remote
 2. systemctl enable --now systemd-journal-remote.socket

Sounds messy. Would you rely on it in production?

Short answer: no
Use rsyslog instead
1. vi /etc/systemd/journald.conf
2. ForwardToSyslog=yes
3. Configure rsyslog like in the good-old-days