STIGQter: STIG Summary: Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Mar 2026:

TOSS 5 must use cron logging.

DISA Rule

SV-282748r1201388_rule

Vulnerability Number

V-282748

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

TOSS-05-000385

Severity

CAT II

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

Configure "rsyslog" to log all cron messages by adding or updating the following line to "/etc/rsyslog.conf" or a configuration file in the /etc/rsyslog.d/ directory:

cron.* /var/log/cron

Restart the rsyslog daemon for the changes to take effect.

$ sudo systemctl restart rsyslog.service

Check Contents

Verify "rsyslog" is configured to log cron events using the following command:

Note: If another logging package is used, substitute the utility configuration file for "/etc/rsyslog.conf" or "/etc/rsyslog.d/*.conf" files.

$ sudo grep -s cron /etc/rsyslog.conf /etc/rsyslog.d/*.conf

/etc/rsyslog.conf:*.info;mail.none;authpriv.none;cron.none /var/log/messages
/etc/rsyslog.conf:cron.* /var/log/cron

If the command does not return a response, check for cron logging all facilities using the following command:

$ sudo grep -s /var/log/messages /etc/rsyslog.conf /etc/rsyslog.d/*.conf

/etc/rsyslog.conf:*.info;mail.none;authpriv.none;cron.none /var/log/messages

If "rsyslog" is not logging messages for the cron facility or all facilities, this is a finding.

Vulnerability Number

V-282748

Documentable

False

Rule Version

TOSS-05-000385

Severity Override Guidance

Check Content Reference

Target Key

5738