Description:Journald (via systemd-journal-remote) supports the ability to send log events it gathers to a remote log host or to receive messages from remote hosts, thus enabling centralised log management. Rationale: Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.Audit: Verify systemd-journal-remote is enabled. Run the following command: # systemctl is-enabled systemd-journal-upload.serviceVerify the output matches: enabled Remediation: Run the following command to enable systemd-journal-remote: # systemctl --now enable systemd-journal-upload.service

[Yes/No]

Run the following command to enable systemd-journal-remote: # systemctl --now enable systemd-journal-upload.service