CIS Benchmark: Understand the journald vs. Rsyslog configuration conflict in RHEL 9 and 10

By default, Red Hat Enterprise Linux (RHEL) 9 and 10 installations run both the systemd-journald and rsyslog services simultaneously. However, starting with CIS Benchmark v2.0.0 for RHEL 9, logging requirements were restructured into mutually exclusive paths. This creates a friction point: the CIS rule ensure_journald_and_rsyslog_not_active_together triggers a FAIL on default systems because the benchmark expects exactly one logging system to be active.

Furthermore, users often encounter conflicting configuration mandates, such as section 6.2.2 requiring ForwardToSyslog=no for Journal, while section 6.2.3 requires ForwardToSyslog=yes for Rsyslog.

Configuration options

The benchmark does not strictly prohibit running both services, but it provides separate configuration sections for each, assuming you pick a primary method. The SSG CIS profiles contain Journal as the default solution. If your environment requires Rsyslog, you must customize your profile. Here is how the benchmark divides these requirements:

The profile selects rules checking Journal configuration by default. Rules checking Rsyslog configuration are available, but the profile does not select them. To use Rsyslog instead of Journal, customize rule selection by using a tailoring file.

Option A: Use Journal

If you choose Journal as your logging solution, disable Rsyslog:

sudo systemctl stop rsyslog
sudo systemctl disable rsyslog

Scan with the default CIS profile:

sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_server_l1 \
  --report rhel-cis-report.html \
  /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml

The default profile includes these rules for Journal configuration:

Option B: Use Rsyslog

If your organization requires Rsyslog, create an XCCDF tailoring file that removes Journal-specific rules and adds Rsyslog rules.

Important: Rsyslog tailoring requires scap-security-guide 0.1.82 or later. Earlier versions lack certain rules in the datastream, which causes oscap to silently skip them.

Step 1: Generate the tailoring file

autotailor --output tailoring.xml \
  --new-profile-id xccdf_org.ssgproject.content_profile_cis_server_l1_rsyslog \
  --select package_rsyslog_installed \
  --select service_rsyslog_enabled \
  --select journald_forward_to_syslog \
  --select rsyslog_filecreatemode \
  --select rsyslog_remote_loghost \
  --select rsyslog_nolisten \
  --select ensure_logrotate_activated \
  --select package_logrotate_installed \
  --select timer_logrotate_enabled \
  --unselect journald_disable_forward_to_syslog \
  --unselect package_systemd-journal-remote_installed \
  --unselect service_systemd-journal-upload_enabled \
  --unselect socket_systemd-journal-remote_disabled \
  --unselect ensure_journald_and_rsyslog_not_active_together \
  /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml \
  xccdf_org.ssgproject.content_profile_cis_server_l1

Step 2: Scan using the tailored profile

sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_server_l1_rsyslog \
  --tailoring-file tailoring.xml \
  --report rhel-cis-rsyslog-report.html \
  /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml

Step 3: Remediate (optional)

sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_server_l1_rsyslog \
  --tailoring-file tailoring.xml \
  --remediate \
  /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml

Tailoring adds these Rsyslog rules:

Adapting for other profiles and RHEL versions

• RHEL 9: Replace ssg-rhel10-ds.xml with ssg-rhel9-ds.xml
• CIS Level 2: Replace cis_server_l1 with cis
• Workstation: Replace cis_server_l1 with cis_workstation_l1 or cis_workstation_l2

Troubleshooting

Check which logging services are active:

systemctl is-active systemd-journald
systemctl is-active rsyslog

If both services return active, you continue to see CIS compliance failures. To resolve this, simply choose the logging architecture that fits your needs and follow the configuration steps outlined in the sections above.

Verify current Journal forwarding configuration:

grep -i ForwardToSyslog /etc/systemd/journald.conf /etc/systemd/journald.conf.d/*.conf 2>/dev/null

Additional resources

• RHEL 10 Scanning for configuration compliance
• RHEL 9 Scanning for configuration compliance
• How to generate tailoring file in oscap?
• CIS Red Hat Enterprise Linux benchmarks
• ComplianceAsCode/content repository