4.2.1.3 Ensure journald is configured to compress large log files

Audit

Review /etc/systemd/journald.conf and verify that large files will be compressed:

# grep ^\s*Compress /etc/systemd/journald.conf

Verify the output matches:

Compress=yes

Remediation

Edit the /etc/systemd/journald.conf file and add the following line:

Compress=yes

Restart the service:

# systemctl restart systemd-journald