# Ensure audit_backlog_limit is sufficient

The 'audit_backlog_limit' parameter defines the maximum number of audit messages that can be queued in kernel memory while waiting to be written to disk by the auditd daemon. It is a critical setting for ensuring the integrity and completeness of the system's audit trail. If this limit is too low on a busy system, the queue can fill up, causing the kernel to drop new audit events. This creates a severe security risk, as an attacker could intentionally generate a high volume of events to overwhelm the buffer and hide malicious activities, effectively blinding the monitoring system. The audit script checks the currently active backlog limit using the 'auditctl' utility. The remediation script modifies the persistent audit rules on disk to set the desired limit and then reloads them to make the change effective immediately and survive reboots. The recommended states are tiered: Basic (8192) is a standard baseline recommended by benchmarks like CIS for most systems. Moderate (16384) provides a larger buffer for servers with higher activity levels. Strict (32768 or more) is intended for high-security or extremely high-load systems where the risk of losing any audit event is unacceptable.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[8192, 'upper bound']` |
| **Moderate** | `[16384, 'upper bound']` |
| **Strict** | `[32768, 'upper bound']` |
| **Type** | `RANGE` |

## Audit Script Working

bash script that executes `auditctl -s | grep "backlog_limit" | awk '{print $2}'` and returns only the numerical value of the current audit backlog limit. The output must be a single number with no additional text or labels.

## Remediation Script Working

bash script that accepts a single numerical value as a positional command-line argument. The script must modify the audit rules, typically located in `/etc/audit/rules.d/audit.rules`, to set the backlog limit by ensuring a line exists that reads `-b <value>`, where `<value>` is the provided argument. If a line with `-b` already exists, it should be updated; otherwise, it should be added. After successfully modifying the configuration, the script must reload the audit rules using `augenrules --load` and return `true`. If it fails at any step, it must return `false`.

