# Ensure logrotate is configured

Necessity: Log rotation is a critical system maintenance task that prevents log files from consuming excessive disk space, which can lead to a denial-of-service (DoS) condition if the disk becomes full. Unmanaged logs can cause system instability or crash critical services. Furthermore, organized and archived logs are essential for security auditing, forensic analysis, and compliance with various regulatory standards. Without logrotate, it is difficult to maintain a manageable and useful audit trail. Auditing and Remediation: The audit script verifies that the 'logrotate' package, which automates the management of log files, is installed on the system. The remediation script installs the 'logrotate' package using the system's native package manager, thereby enabling automated log management capabilities. Recommended State Rationale: For all security levels—Basic, Moderate, and Strict—the recommended state is 'Installed'. The presence of the logrotate utility is a fundamental requirement for a securely configured and manageable system. There is no lesser or greater state for its installation; it is either present and functional or it is not. While the specific configuration of logrotate rules can be tuned for different security postures, the installation of the tool itself is a universal baseline requirement.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Installed']` |
| **Moderate** | `['Installed']` |
| **Strict** | `['Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'logrotate' package is installed using 'dpkg-query'. The script must output 'Installed' if the package is present and 'Not Installed' otherwise. The output must consist solely of the status string, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired state (e.g., 'Installed'). If the argument is 'Installed', the script must use 'apt-get install -y logrotate' to ensure the package is present. The script must return 'true' if the package is successfully installed or already present, and 'false' upon failure.

