Persistent system logs
medium on-server
What it inspects
Whether the directory /var/log/journal exists (which means persistent logging); if so it passes. Otherwise it reads /etc/systemd/journald.conf for a Storage= line: persistent passes, any other value warns, and no value warns because the default (auto) is volatile when the directory is absent. Drop-in files in journald.conf.d are not read, but they work because journald creates the directory.
Why it matters
With volatile logs, a reboot or crash erases the journal, which is often the very evidence you need afterwards: why the machine restarted, what happened before a break-in. Persistent storage costs some disk space and gives you history across reboots.
How to verify
ls -ld /var/log/journal
grep -rE '^[[:space:]]*Storage' /etc/systemd/journald.conf /etc/systemd/journald.conf.d/ 2>/dev/null
journalctl --disk-usage
How to fix
Write a Storage=persistent drop-in in /etc/systemd/journald.conf.d, create /var/log/journal, and restart journald.
Make the journal persistent
Any distro
# Keeps the systemd journal on disk so logs survive a reboot. Disk use is bounded by journald's defaults
# (a share of the filesystem); to set a hard cap, add a line such as SystemMaxUse=500M to the drop-in below.
mkdir -p /etc/systemd/journald.conf.d
install -m 0644 /dev/stdin /etc/systemd/journald.conf.d/90-umbermark-persistent.conf <<'EOF'
[Journal]
Storage=persistent
EOF
mkdir -p /var/log/journal
systemd-tmpfiles --create --prefix /var/log/journal
systemctl restart systemd-journald
journalctl --disk-usage