Puppet Class: cis_security_hardening::rules::logrotate

Defined in:
manifests/rules/logrotate.pp

Summary

Ensure logrotate is configured

Overview

The system includes the capability of rotating log files regularly to avoid filling up the system with logs or making the logs unmanageable large. The file /etc/logrotate.d/syslog is the configuration file used to rotate log files created by syslog or rsyslog.

Rationale: By keeping the log files smaller and more manageable, a system administrator can easily archive these files to another system and spend less time looking through inordinately large log files.

Examples:

class { 'cis_security_hardening::rules::logrotate':
    enforce => true,
}

Parameters:

  • enforce (Boolean) (defaults to: false) —

    Enforce the rule

  • dateext (Boolean) (defaults to: true) —

    Use date extension for rotated files.

  • compress (Boolean) (defaults to: true) —

    Compress rotated files.

  • delaycompress (Boolean) (defaults to: false) —

    Delay compression of rotated files.

  • rotate (Integer) (defaults to: 7) —

    Number of rotations to keep.

  • rotate_every (String) (defaults to: 'week') —

    Frequency of rotation (e.g., ‘daily’, ‘weekly’).

  • ifempty (Boolean) (defaults to: true) —

    Rotate the log file even if it is empty.

  • su (Boolean) (defaults to: false) —

    Use su directive for logrotate.

  • su_user (String) (defaults to: 'root') —

    User for logrotate.

  • su_group (String) (defaults to: 'syslog') —

    Group for logrotate.



39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
 
# File 'manifests/rules/logrotate.pp', line 39

class cis_security_hardening::rules::logrotate (
  Boolean $enforce       = false,
  Boolean $dateext       = true,
  Boolean $compress      = true,
  Boolean $delaycompress = false,
  Integer $rotate        = 7,
  String $rotate_every   = 'week',
  Boolean $ifempty       = true,
  Boolean $su            = false,
  String $su_user        = 'root',
  String $su_group       = 'syslog',
) {
  if $enforce {
    class { 'logrotate':
      create_base_rules => false,
      config            => {
        dateext       => $dateext,
        compress      => $compress,
        delaycompress => $delaycompress,
        rotate        => $rotate,
        rotate_every  => $rotate_every,
        ifempty       => $ifempty,
        su            => $su,
        su_user       => $su_user,
        su_group      => $su_group,
      },
    }
  }
}