# Ensure system is disabled when audit logs are full

Necessity: The integrity and availability of audit logs are critical for security monitoring, forensic analysis, and compliance. If the disk partition holding the logs fills up, the system must take decisive action to prevent the loss of new audit data. An attacker could intentionally fill the audit logs to hide their subsequent malicious activities. Configuring the system to shut down or enter a protected state ensures that no actions can occur without being logged, thereby preserving the audit trail. Remediation and Auditing: The audit script inspects the `admin_space_left_action` parameter within `/etc/audit/auditd.conf` to determine the system's configured response when audit log storage is critically low. The remediation script modifies this parameter to the desired state and reloads the auditd service to enforce the new policy. Recommended State Rationale: Basic ('SUSPEND'): This state stops the audit daemon from logging any further events, preventing log overwrites but allowing the system to continue operating. This is a minimum baseline that prioritizes system availability over audit integrity, as new security-relevant events will be missed. Moderate ('SINGLE'): This state brings the system down to single-user mode. It is a significant security improvement as it terminates normal user sessions and services, preventing most unlogged activity while still allowing an administrator console access to resolve the disk space issue. Strict ('HALT'): This is the most secure configuration, recommended by benchmarks like DISA STIG. It immediately shuts down the system, ensuring that the system state is preserved and no further actions can be taken that would evade auditing. This prioritizes forensic integrity and data preservation above system availability and is essential for high-security environments.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['SUSPEND']` |
| **Moderate** | `['SINGLE']` |
| **Strict** | `['HALT']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the `/etc/audit/auditd.conf` file for the value of the `admin_space_left_action` setting. The script must parse the file, extract only the value (e.g., 'SUSPEND', 'HALT'), trim any whitespace, and output it to standard output with no extra text or labels.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired state for the `admin_space_left_action` setting (e.g., 'HALT'). The script should use `sed` to find and replace the value on the line beginning with `admin_space_left_action` in `/etc/audit/auditd.conf`. If the setting does not exist, the script should add it. After modification, the script must reload the auditd service configuration. The script must return `true` upon successful modification and `false` otherwise.

