Added new options rsyslog logrotate

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

defaults/main.yml

@@ -1118,6 +1118,23 @@ rhel9cis_remote_log_retrycount: 100
 # of rsyslog forwarding must be enabled('rhel9cis_remote_log_server: true').
 rhel9cis_remote_log_queuesize: 1000
 
+## Control 6.2.3.8 rsyslog log rotate option
+# These variable allow you to change accordint to site policy settings
+# When to rotate options: hourly, daily, weekly, monthly, yearly
+rhel9cis_rsyslog_logrotate_rotated: weekly
+# Number of backlog files to keep
+rhel9cis_rsyslog_logrotate_keep: 4
+# compress file once rotated, false will not compress
+rhel9cis_rsyslog_logrotate_compress: true
+# If the log file is missing, go on to the next one without issuing an error message
+rhel9cis_rsyslog_logrotate_missingok:
+# Dont rotate file if has no contents, false will still rotate
+rhel9cis_rsyslog_logrotate_notifempty: true
+# rhel9cis_rsyslog_logrotate_create give the options to create permissions and ownerships
+# allows create iption to be used and sets options below based on mode owner group
+rhel9cis_rsyslog_logrotate_create: false
+rhel9cis_rsyslog_logrotate_create_opts: 0640 root root
+
 ## Control 6.2.2.1.2 - Ensure systemd-journal-remote is configured
 # 'rhel9cis_journal_upload_url' is the ip address to upload the journal entries to
 #  URL value may specify either just the hostname or both the protocol and hostname. 'https' is the default. The port

tasks/section_6/cis_6.2.3.x.yml

@@ -237,7 +237,7 @@
         - 'ModLoad imtcp'
         - 'InputTCPServerRun'
 
-- name: "6.2.3.8 | PATCH | Ensure logrotate is configured"
+- name: "6.2.3.8 | PATCH | Ensure rsyslog logrotate is configured"
   when:
     - rhel9cis_rule_6_2_3_8
   tags:
@@ -249,45 +249,21 @@
     - rule_6.2.3.8
     - NIST800-53R5_AU-8
   block:
-    - name: "6.2.3.8 | PATCH | Ensure logrotate is configured | installed"
+    - name: "6.2.3.8 | PATCH | Ensure rsyslog logrotate is configured | installed"
       ansible.builtin.package:
         name: rsyslog-logrotate
         state: present
 
-    - name: "6.2.3.8 | PATCH | Ensure logrotate is configured | scheduled"
+    - name: "6.2.3.8 | PATCH | Ensure rsyslog logrotate is configured | scheduled"
       ansible.builtin.systemd:
         name: logrotate.timer
         state: started
         enabled: true
 
-    - name: "6.2.3.8 | PATCH | Ensure logrotate is configured | set default conf"
-      ansible.builtin.replace:
-        path: "/etc/logrotate.conf"
-        regexp: '^(\s*)(daily|weekly|monthly|yearly)$'
-        replace: "\\1{{ rhel9cis_logrotate }}"
-
-    - name: "6.2.3.8 | AUDIT | Ensure logrotate is configured | Get non default logrotate settings"
-      ansible.builtin.find:
-        paths: /etc/logrotate.d/
-        contains: '^(\s*)(?!{{ rhel9cis_logrotate }})(daily|weekly|monthly|yearly)$'
-      register: log_rotates
-
-    - name: "6.2.3.8 | AUDIT | Ensure logrotate is configured"
-      when: log_rotates.matched > 0
-      vars:
-        warn_control_id: '6.2.3.8'
-      block:
-        - name: "6.2.3.8 | AUDIT | Ensure logrotate is configured | generate file list"
-          ansible.builtin.set_fact:
-            logrotate_non_def_conf: "{{ log_rotates.files | map(attribute='path') | join (', ') }}"
-
-        - name: "6.2.3.8 | AUDIT | Ensure logrotate is configured | List configured files"
-          ansible.builtin.debug:
-            msg: |
-              "Warning!! The following files are not covered by default logrotate settings ensure they match site policy"
-              "{{ logrotate_non_def_conf }}"
-          loop: "{{ log_rotates.files }}"
-
-        - name: "6.2.3.8 | AUDIT | Ensure logrotate is configured | Warning count"
-          ansible.builtin.import_tasks:
-            file: warning_facts.yml
+    - name: "6.2.3.8 | PATCH | Ensure logrotate is configured | set rsyslog conf"
+      ansible.builtin.template:
+        src: etc/logrotate.d/rsyslog.conf.j2
+        dest:  /etc/logrotate.d/rsyslog.conf
+        owner: root
+        group: root
+        mode: '0640'

templates/etc/logrotate.d/rsyslog.conf.j2

@@ -0,0 +1,11 @@
+/var/log/rsyslog/*.log {
+    {{ rhel9cis_rsyslog_logrotate_rotated }}
+    rotate {{ rhel9cis_rsyslog_logrotate_keep }}
+    {% if rhel9cis_rsyslog_logrotate_compress %}compress{% else %}nocompress{% endif %}
+    {% if rhel9cis_rsyslog_logrotate_missingok %}missingok{% else %}missingok{% endif %}
+    {% if rhel9cis_rsyslog_logrotate_notifempty %}notifempty{% else %}ifempty{% endif %}
+    {% if rhel9cis_rsyslog_logrotate_create %}create {{ rhel9cis_rsyslog_logrotate_create_opts }}{% endif %}
+    postrotate
+        /usr/bin/systemctl reload rsyslog.service >/dev/null || true
+    endscript
+}