diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/rule.yml index b047e475d92..a6791060c1c 100644 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/rule.yml +++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/rule.yml @@ -2,32 +2,24 @@ documentation_complete: true title: 'Ensure Log Files Are Owned By Appropriate Group' -description: |- - The group-owner of all log files written by - rsyslog should be -{{% if 'debian' in product or 'ubuntu' in product %}} - adm. +{{% if "ubuntu" in product or "debian" in product %}} + {{% set target_group="adm" %}} {{% else %}} - root. + {{% set target_group="root" %}} {{% endif %}} + +description: |- + The group-owner of all log files written by + rsyslog should be {{{ target_group }}}. These log files are determined by the second part of each Rule line in /etc/rsyslog.conf and typically all appear in /var/log. For each log file LOGFILE referenced in /etc/rsyslog.conf, run the following command to inspect the file's group owner:
$ ls -l LOGFILE- If the owner is not - {{% if 'debian' in product or 'ubuntu' in product %}} - adm, - {{% else %}} - root, - {{% endif %}} + If the owner is not {{{ target_group }}}, run the following command to correct this: -{{% if 'debian' in product or 'ubuntu' in product %}} -
$ sudo chgrp adm LOGFILE-{{% else %}} -
$ sudo chgrp root LOGFILE-{{% endif %}} +
$ sudo chgrp {{{ target_group }}} LOGFILErationale: |- The log files generated by rsyslog contain valuable information regarding system @@ -65,11 +57,7 @@ ocil_clause: 'the group-owner is not correct' ocil: |- The group-owner of all log files written by rsyslog should be - {{% if 'debian' in product or 'ubuntu' in product %}} - adm. - {{% else %}} - root. - {{% endif %}} + {{{ target_group }}}. These log files are determined by the second part of each Rule line in /etc/rsyslog.conf and typically all appear in /var/log. To see the group-owner of a given log file, run the following command: @@ -79,9 +67,4 @@ template: name: rsyslog_logfiles_attributes_modify vars: attribute: groupowner - value: root - value@debian10: adm - value@debian11: adm - value@ubuntu1604: adm - value@ubuntu2004: adm - value@ubuntu2204: adm + value: {{{ target_group }}}