4.2.1.4 Ensure journald is configured to write logfiles to persistent disk

Audit

Review /etc/systemd/journald.conf and verify that logs are persisted to disk:

# grep ^\s*Storage /etc/systemd/journald.conf

Verify the output matches:

Storage=persistent

Remediation

Edit the /etc/systemd/journald.conf file and add the following line:

Storage=persistent

Restart the service:

# systemctl restart systemd-journald