# Ensure journald service is enabled and active

Necessity: The systemd-journald service is the core component for collecting and managing log data on modern Linux systems, including CentOS. It captures messages from the kernel, early user space, standard output/error of services, and other sources. Enabling this service is critical for security auditing, forensic analysis, and system troubleshooting. Disabling it would result in a complete loss of local logging capabilities, severely hindering the ability to detect, investigate, and respond to security incidents or operational failures. Risk of Misconfiguration: An inactive or disabled journald service creates a significant security blind spot, making it impossible to trace unauthorized activities, diagnose system crashes, or meet compliance requirements for logging and monitoring. Auditing and Remediation: The audit script verifies that the 'systemd-journald' service is configured to start on boot and is currently running, which are essential for continuous logging. The remediation script provides a direct method to enforce this state using the standard 'systemctl' command, ensuring the logging daemon is properly activated. Recommended State Rationale: Basic, Moderate, and Strict states are all set to 'enabled'. For this control, the state is binary; the logging service is either functional or it is not. There is no middle ground or less secure but acceptable alternative. Any state other than 'enabled' is considered a critical security vulnerability. Therefore, all security hardening levels mandate that the service must be active and enabled to ensure system integrity and accountability.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the 'systemd-journald' service. The script must query if the service is both enabled to start at boot and currently active. If both conditions are true, the script must output the string 'enabled'. Otherwise, it must output 'disabled'. The output must only contain the resulting status string, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional command-line argument to set the state of the 'systemd-journald' service. If the argument is 'enabled', the script must use 'systemctl enable --now systemd-journald' to enable and start the service. If the argument is 'disabled', it must use 'systemctl disable --now systemd-journald' to disable and stop it. The script must return the string 'true' upon successful execution of the command and 'false' if the command fails.

