documentation_complete: true

title: 'Enable systemd-journal-upload Service'

description: |-
    The <tt>systemd-journal-upload</tt> service is part of the <tt>systemd-journal-remote</tt> package
    and enables centralized logging by uploading local systemd journal entries to a remote log
    server via HTTPS. This service acts as a client that pushes journal data to a remote host
    running the <tt>systemd-journal-remote</tt> receiver service.
    {{{ describe_service_enable(service="systemd-journal-upload") }}}

rationale: |-
    Centralized logging through <tt>systemd-journal-upload</tt> is essential for security monitoring,
    incident response, and compliance requirements. Storing log data on a remote host protects log
    integrity from local attacks. If an attacker gains root access on the local system, they could
    tamper with or remove log data stored locally to hide their activities. Remote logging ensures
    that audit trails remain intact even if the local system is compromised. Additionally,
    centralized logs facilitate correlation of events across multiple systems, enabling better
    detection of distributed attacks and security incidents.

severity: medium

identifiers:
    cce@rhel8: CCE-87557-5
    cce@rhel10: CCE-86711-9
    cce@sle15: CCE-92604-8
    cce@slmicro5: CCE-94084-1
    cce@slmicro6: CCE-94735-8

references:
    srg: SRG-OS-000479-GPOS-00224

ocil_clause: 'the systemd-journal-upload service is not running'

ocil: |-
    {{{ ocil_service_enabled(service="systemd-journal-upload") }}}

fixtext: |-
    {{{ fixtext_service_enabled("systemd-journal-upload") }}}

srg_requirement: '{{{ srg_requirement_service_enabled("systemd-journal-upload") }}}'

platform: machine and package[systemd-journal-remote]

template:
    name: service_enabled
    vars:
        servicename: systemd-journal-upload
        packagename: systemd-journal-remote

warnings:
    - general: |-
        The <tt>systemd-journal-upload</tt> service will fail to start if the remote server URL is not configured.
        Edit <tt>/etc/systemd/journal-upload.conf</tt> to configure the remote server URL.
