# Ensure separate partition exists for /var/log

Necessity: Separating /var/log into its own partition is crucial for system stability and security. It prevents log-generating services, whether through normal operation or a Denial-of-Service (DoS) attack, from consuming all available space on the root filesystem. If the root filesystem fills up, the entire system can become unresponsive, leading to a complete loss of availability. Additionally, a separate partition allows for specific, restrictive mount options (such as 'noexec', 'nosuid', 'nodev') to be applied, hardening the system by preventing the execution of any malicious code that might be injected into log files.

Auditing and Remediation: The audit script verifies the system's mount points to determine if '/var/log' corresponds to a distinct filesystem. Remediation is a complex, manual process that requires a system administrator to provision a new partition, format it, move existing log data, and configure the system's filesystem table (/etc/fstab) to mount it automatically on boot. Due to the high risk of data loss and system-specific disk layouts, this procedure cannot be safely automated.

Recommended State Rationale: The recommendation is 'Mounted' for all levels (Basic, Moderate, and Strict) because this is a foundational best practice with no intermediate state. The system either benefits from the protection of a separate partition, or it remains vulnerable to the risks of a filled root filesystem. This configuration is a standard recommendation in security hardening guides, including the CIS Benchmarks, as an essential measure for ensuring system integrity and availability.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Mounted']` |
| **Moderate** | `['Mounted']` |
| **Strict** | `['Mounted']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if '/var/log' is mounted as a separate partition. The script must output only the string 'true' if it is a separate partition and 'false' if it is not, with no additional text or formatting.

## Remediation Script Working

This configuration cannot be remediated automatically with a simple script, as it requires manual, system-specific actions such as partitioning disks, creating filesystems, migrating data, and updating /etc/fstab. The script should be designed to indicate that manual intervention is required and must return 'false'.

