# Ensure rsyslog is installed

Necessity: The `rsyslog` service is a fundamental component for system logging on Linux systems. It is responsible for collecting, processing, and forwarding log messages from various applications and system components. Without a functioning log collection utility like `rsyslog`, there would be no persistent record of system events, which is critical for security monitoring, incident response, troubleshooting, and compliance auditing. A misconfiguration or absence of `rsyslog` creates a significant security blind spot, making it nearly impossible to detect unauthorized access, system errors, or malicious activity.

Auditing and Remediation: The audit script verifies the installation status of the `rsyslog` package using the Debian package manager (`dpkg`). The remediation script leverages the `apt-get` package manager to either install (`install`) or completely remove (`purge`) the `rsyslog` package to enforce the desired security state.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'Installed'. This is because system logging is a foundational security control, not a graded feature. For any level of security hardening, the complete absence of a system logger is unacceptable. 
- **Basic:** Any server, even for development, requires logging for basic troubleshooting and operational awareness. 
- **Moderate:** In more controlled environments, robust logging is essential for meeting compliance standards and enabling effective security monitoring.
- **Strict:** For high-security systems, comprehensive and reliable logging is non-negotiable for forensic analysis and real-time threat detection. Therefore, `rsyslog` must always be installed.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Installed']` |
| **Moderate** | `['Installed']` |
| **Strict** | `['Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the `rsyslog` package is installed. The script should use `dpkg-query` to verify the package status. If the package is installed, the script must output the string 'Installed'. If it is not installed, it must output 'Not Installed'. Ensure no other text or formatting is included in the output.

## Remediation Script Working

Bash script that accepts a single positional command-line argument, which will be the desired state ('Installed' or 'Not Installed'). If the argument is 'Installed', the script must use `apt-get install -y rsyslog` to install the package. If the argument is 'Not Installed', it must use `apt-get purge -y rsyslog` to remove it. The script must output `true` on successful completion of the action and `false` on failure or if an invalid argument is provided.

