# Ensure rsyslog is configured to send logs to a remote log host

Necessity: Configuring a system to send logs to a remote host is a critical security practice for centralized monitoring and incident response. It ensures log data is preserved even if the local system is compromised, shut down, or has its local logs tampered with or deleted by an attacker. Centralized logs are essential for correlating events across multiple systems to detect widespread attacks and for meeting various compliance framework requirements (e.g., PCI-DSS, HIPAA). The primary risk of not implementing this is the complete loss of forensic data following a security breach, severely hindering investigation and recovery. Auditing and Remediation: The audit script verifies that the rsyslog service is actively configured to forward log messages to another machine by inspecting its configuration files for a forwarding rule. The remediation script automates the process of enabling or disabling this forwarding rule, typically by adding or removing a dedicated configuration file, and then restarting the rsyslog service to ensure the new state is applied. Recommended State Rationale: The recommended state is consistently 'Enabled' across all levels (Basic, Moderate, and Strict) because remote logging is a foundational security control, not a tunable parameter. Basic: At a minimum, logs must be sent to a central location to prevent data loss. Moderate: This level reinforces the necessity of the Basic state; there is no secure middle ground. Strict: In a high-security environment, not only is remote logging mandatory, but it would be coupled with other strict controls like using TLS for encrypted log transport (a separate configuration), further underscoring that the feature must be 'Enabled'.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script to inspect the active rsyslog configuration by checking `/etc/rsyslog.conf` and all files within `/etc/rsyslog.d/`. The script must determine if logs are being forwarded to a remote server by searching for an uncommented line that begins with an action selector (e.g., `*.*`) followed by a remote host specifier (`@` for UDP or `@@` for TCP). The script should output 'Enabled' if such a configuration is found, and 'Disabled' otherwise. The output must exclusively be the status string.

## Remediation Script Working

bash script that accepts one positional argument: 'Enabled' or 'Disabled'. When the argument is 'Enabled', the script must create a new configuration file (e.g., `/etc/rsyslog.d/99-remotelog.conf`) containing a directive to forward all logs (`*.*`) to a predefined remote log host (e.g., `*.* @@loghost.example.com`). When the argument is 'Disabled', the script must remove or disable this remote logging configuration. The script must then restart the rsyslog service to apply the change. The script shall return 'true' upon success and 'false' upon failure.

