# Ensure system warns when audit logs are low on space

The `space_left_action` parameter determines what action the system takes when the disk partition holding the audit logs is running low on space. It is critical to configure this setting to prevent the loss of audit data. If the audit log partition fills up and the system is configured to ignore it, subsequent security-relevant events will not be recorded, creating a significant security blind spot and allowing an attacker to potentially cover their tracks. The audit script reads the current configured action from `/etc/audit/auditd.conf`, while the remediation script sets this configuration to the desired state. The recommended states are justified as follows: 'Basic' (`SYSLOG`) ensures that a warning is written to the system log, which can be centrally collected and monitored. This is a minimum requirement for awareness. 'Moderate' (`EMAIL`) provides a more direct notification by sending an email to the administrator, prompting a faster human response, assuming a mail transfer agent is configured. 'Strict' (`HALT`) is the most secure option, as it prioritizes the integrity of the audit trail above system availability. By shutting down the system, it prevents any further actions from occurring that cannot be logged, which is essential for high-security environments where a complete audit record is non-negotiable.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['SYSLOG']` |
| **Moderate** | `['EMAIL']` |
| **Strict** | `['HALT']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that reads the `/etc/audit/auditd.conf` file and extracts the value of the `space_left_action` setting. The script must output only the value itself, with no labels or additional text.

## Remediation Script Working

Bash script that accepts a single positional argument, which is the desired value for the `space_left_action` setting (e.g., 'SYSLOG'). The script should modify the `/etc/audit/auditd.conf` file, setting `space_left_action` to the provided value. If the setting does not exist, it should be added. The script must return `true` on success and `false` on failure.

