# Ensure auditd service is enabled and active

The Linux Audit Daemon (auditd) is the userspace component of the Linux Auditing System. It is responsible for writing audit records to the disk. Without auditd, the kernel's audit events would be lost, rendering the system incapable of logging security-relevant activities such as file access, system calls, and user commands. Ensuring the service is enabled and active is critical for intrusion detection, forensic analysis, and compliance with security standards.

The audit script verifies the runtime and boot-time status of the auditd service via systemd. The remediation script uses systemd's `enable --now` command to configure the service to start on boot and to start it in the current session.

The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'enabled-active'. This is a binary control; the audit daemon must be running for any logging to occur. There is no intermediate state of partial security. Any state other than 'enabled-active' represents a critical logging failure, making it impossible to track and investigate security events on the system.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled-active']` |
| **Moderate** | `['enabled-active']` |
| **Strict** | `['enabled-active']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the 'auditd' service. The script must use `systemctl is-enabled auditd` and `systemctl is-active auditd` to determine the service's state. It must output a single, combined string in the format 'enabled-active', 'enabled-inactive', 'disabled-active', or 'disabled-inactive' with no other text or labels.

## Remediation Script Working

Bash script that accepts a single string argument representing the desired state. If the argument is 'enabled-active', the script must execute `systemctl enable --now auditd` to enable and start the service. The script must return the boolean `true` on success or `false` on failure.

