# Ensure system warns when audit logs are low on space

Necessity: The audit log is a critical component for security monitoring, intrusion detection, and forensic analysis. If the partition holding the audit logs runs out of space, the audit daemon can no longer record security-relevant events. This creates a significant security blind spot, as unauthorized activities could occur without being logged. The `space_left_action` setting defines the system's response when disk space becomes critically low, preventing the silent failure of the logging system. Misconfiguration could lead to a complete loss of audit trails during a critical incident. Auditing and Remediation: The audit script verifies the system's configured response to a low-space condition by reading the `space_left_action` parameter in `/etc/audit/auditd.conf`. The remediation script modifies this same parameter to align with the desired security policy, ensuring the system takes an appropriate action when audit logs are at risk of being lost. Recommended State Rationale: Basic: Setting the action to 'SYSLOG' is the minimum requirement for awareness. It ensures that a warning message is written to the system log when disk space is low, which can be captured by centralized logging and monitoring systems. This is a passive but essential notification. Moderate: The 'EMAIL' action provides a more proactive notification by sending an alert directly to a predefined administrator alias. This increases the likelihood of a timely human intervention to resolve the space issue before logging is suspended. This assumes the system's mail transfer agent (MTA) is correctly configured. Strict: The 'HALT' action provides the highest level of audit integrity. In high-security environments where no loss of audit data is acceptable, this setting will shut down the system when it can no longer guarantee that events are being logged. This prioritizes the integrity of the audit trail over system availability, preventing any un-audited actions from taking place.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['SYSLOG']` |
| **Moderate** | `['EMAIL']` |
| **Strict** | `['HALT']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that reads the `/etc/audit/auditd.conf` file and extracts the value of the `space_left_action` setting. The script must output only the value of the setting (e.g., 'SYSLOG'), with no extra text or formatting.

## Remediation Script Working

shell script that accepts a single positional command-line argument, which is the desired action for the `space_left_action` setting. The script must modify the `/etc/audit/auditd.conf` file, setting `space_left_action` to the provided value. If the setting does not exist, it should be added. The script must output `true` on successful modification and `false` on failure.

