# Ensure audit logs are not automatically deleted

Necessity: The `max_log_file_action` parameter determines the system's behavior when the audit log files reach their maximum configured size. Preventing automatic deletion is critical for security forensics and compliance. If logs are deleted automatically, crucial evidence of a security breach, unauthorized access, or system compromise could be permanently lost, severely hindering incident response and investigation. Misconfiguration could lead to a false sense of security where logging is perceived to be active but is silently failing or deleting data.

Auditing and Remediation: The audit script inspects the `/etc/audit/auditd.conf` configuration file to verify the current value of the `max_log_file_action` directive. The remediation script modifies this same file, changing the directive to the desired value, thereby altering how the audit daemon (`auditd`) handles a full log disk.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is `['keep_logs']`. This is because any other setting (`rotate`, `syslog`, `suspend`) can result in the loss of audit data when the disk partition fills up. The `keep_logs` setting is the only one that guarantees data preservation by stopping the logging process and forcing administrative intervention to archive logs and free up space. This ensures that no event is ever silently dropped, which is a foundational requirement for any secure and compliant system. This approach aligns with security best practices and benchmarks like CIS, which mandate the preservation of all audit records.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['keep_logs']` |
| **Moderate** | `['keep_logs']` |
| **Strict** | `['keep_logs']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that reads the `/etc/audit/auditd.conf` file, finds the `max_log_file_action` setting, and prints only its value. The script should trim any leading/trailing whitespace from the value and ignore commented lines.

## Remediation Script Working

bash script that takes a single positional argument representing the desired state for `max_log_file_action`. The script should modify the `/etc/audit/auditd.conf` file, setting `max_log_file_action` to the provided value. If the setting does not exist, it should be added. The script must output `true` on successful modification and `false` if it fails.

