# Ensure journald is configured to send logs to rsyslog

Necessity: Centralizing log data is a fundamental security practice. The systemd journal (journald) is the primary logging mechanism on modern Linux systems, while rsyslog is a long-standing and powerful syslog daemon used for log aggregation and forwarding to SIEMs. Ensuring that journald forwards its logs to rsyslog prevents log data fragmentation and creates a single, comprehensive source for system auditing, threat detection, and incident response. Misconfiguration can lead to security blind spots where critical events are not captured by monitoring systems. Auditing and Remediation: The audit script verifies the 'ForwardToSyslog' directive within the '/etc/systemd/journald.conf' configuration file. The remediation script modifies this file to set 'ForwardToSyslog' to the desired state and reloads the journald service to apply the change, thereby enabling or disabling the log forwarding functionality. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'yes'. This is a binary, foundational setting. For any level of security hardening, complete and centralized logging is non-negotiable. There is no intermediate state; logs are either forwarded for aggregation or they are not. Therefore, the most secure and only recommended configuration is to have this feature enabled across all security postures.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['yes']` |
| **Moderate** | `['yes']` |
| **Strict** | `['yes']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the '/etc/systemd/journald.conf' file to determine the effective value of the 'ForwardToSyslog' setting. The script must parse the file, account for commented lines, and return only the effective value ('yes' or 'no'), with 'yes' being the default if the setting is not explicitly defined. The output should contain no extra text or labels.

## Remediation Script Working

Bash script that accepts a single positional argument ('yes' or 'no') to configure the 'ForwardToSyslog' setting in '/etc/systemd/journald.conf'. The script must uncomment or add the setting under the '[Journal]' section with the provided value. After updating the file, the script must restart the 'systemd-journald' service. It must return 'true' upon successful completion or 'false' if it fails.

