# Ensure rsyslog logging is configured

Necessity: The rsyslog service is fundamental for system logging on CentOS. It collects, processes, and forwards system log messages from various sources. Centralized logging is a critical security control for detecting anomalies, monitoring for security events, reconstructing incidents for forensic analysis, and ensuring compliance with regulatory standards. Disabling rsyslog creates a significant visibility gap, rendering incident response and troubleshooting efforts extremely difficult, if not impossible. The primary risk of misconfiguration is the complete loss of audit trails, which could allow an attacker to operate undetected. Auditing and Remediation: The audit script verifies the operational state of the rsyslog service by checking if it is installed and enabled within systemd. The remediation script ensures the rsyslog package is installed via the system's package manager and then uses 'systemctl' to enable and start the service, establishing the baseline for system-wide logging. Recommended State Rationale: Basic, Moderate, and Strict: All three security levels recommend the state be 'enabled'. System logging is a foundational and non-negotiable security requirement. There is no acceptable less-secure state. The 'enabled' state ensures that logs are actively being collected, which is the minimum requirement for any level of system security and operational awareness. For moderate and strict environments, this configuration would be the starting point, typically augmented with secure log forwarding to a centralized SIEM, file permission hardening, and more granular logging rules, but the service itself must always be enabled.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the rsyslog service. The script must query systemd to determine if the service is enabled. It should output 'enabled' if the service is enabled, 'disabled' if it is installed but not enabled, and 'Not Installed' if the rsyslog package is not present on the system. The script must only return the status string, with no additional text.

## Remediation Script Working

Bash script that accepts one positional argument for the desired state, which should be 'enabled'. The script must first use the system's package manager (e.g., yum or dnf) to install the rsyslog package if it is not already installed. It should then enable and start the rsyslog service using 'systemctl enable --now rsyslog'. The script must return the string 'true' upon successful completion or 'false' if any step fails.

