RHEL-08-010070 Task Causes Duplicate Logs

[JacobBuskirk]

Describe the Issue
The implementation of RHEL-08-010070 causes duplicate logs for auth.*;authpriv.*;daemon.* facilities when applied on a default install of RHEL 8. By default RHEL 8 is configured as follows:

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

The task for RHEL-08-010070 adds the following line:

auth.*;authpriv.*;daemon.* /var/log/secure

The *.info in the default /var/log/messages task matches everything in auth.* and daemon.* other than debug, and authpriv.* is already in /var/log/secure by default. This causes duplicate logs to be written to the system.

Expected Behavior
rsyslog configuration should not cause duplicate log messages

Actual Behavior
rsyslog configuration causes duplicate log messages

Control(s) Affected
What controls are being affected by the issue
RHEL-08-010070

Environment (please complete the following information):

• branch being used: [e.g. devel] devel
• Ansible Version: [e.g. 2.10] 2.15
• Host Python Version: [e.g. Python 3.7.6] 3.9
• Ansible Server Python Version: [e.g. Python 3.7.6] 3.9
• Additional Details:

Additional Notes
Anything additional goes here

Possible Solution
Check if auth.*, authpriv.*, and daemon.* are already set. Add auth.* and daemon.* to the default /var/log/messages line instead of /var/log/secure in order to avoid duplicate logs. The STIG check indicates only that auth.*, authpriv.*, and daemon.* have to be defined, not that they have to be in /var/log/secure. Verify that authpriv.* is set under /var/log/secure and if it isn't, add it.

[uk-bolly]

hi @JacobBuskirk

I believe this issue has been addressed and merged?
I will close this, but feel free to reopen if you are still experiencing this problem.

many thanks

uk-bolly