# Ensure journald log file rotation is configured

The necessity of configuring journald log file rotation is to balance log retention with system stability. Uncontrolled log growth can exhaust disk space, leading to a denial-of-service condition where the system becomes unstable or crashes. Proper rotation ensures that a sufficient history of events is preserved for security audits, troubleshooting, and forensic analysis without jeopardizing system resources. The audit script checks the 'SystemMaxUse' setting in '/etc/systemd/journald.conf' to determine the maximum disk space the journal may use. The remediation script sets this value, ensuring the system enforces a defined log retention policy. The recommended states provide a tiered approach to this balance: Basic ([500, 1023] MB) is suitable for systems with limited disk space, ensuring essential logging without significant storage impact. Moderate ([1024, 4095] MB) is recommended for standard production servers, retaining several weeks or months of logs for effective incident response. Strict ([4096, 'upper bound'] MB) is intended for high-security environments or systems with ample storage, maximizing data retention for comprehensive, long-term forensic analysis.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[500, 'upper bound']` |
| **Moderate** | `[1024, 'upper bound']` |
| **Strict** | `[4096, 'upper bound']` |
| **Type** | `RANGE` |

## Audit Script Working

shell script that inspects the '/etc/systemd/journald.conf' file. The script must parse the value of the 'SystemMaxUse' directive. It should handle values specified in Megabytes (M) or Gigabytes (G), converting them to a base unit of Megabytes. The script must output only the final numeric value in MB, with no extra text or labels.

## Remediation Script Working

shell script that accepts a single positional numeric argument representing the desired maximum total size of journal files in Megabytes (MB). The script must configure the 'SystemMaxUse' directive in '/etc/systemd/journald.conf' to this value, appending 'M' to it (e.g., 'SystemMaxUse=500M'). If the directive is commented out, it should be uncommented; if it does not exist, it should be added under the '[Journal]' section. After successfully modifying the configuration, the script must restart the 'systemd-journald' service. The script must output 'true' upon successful completion or 'false' if any step fails.

