# Ensure system is disabled when audit logs are full

The `admin_space_left_action` parameter determines the action the system takes when the disk space remaining for audit logs drops to a critical level. This is crucial for maintaining the integrity of the audit trail. If audit logs are full and the system continues operating, new security-relevant events will not be recorded, creating a significant blind spot that an attacker could exploit to cover their tracks. Misconfiguration could lead to a complete loss of forensic data following a security incident. The audit script checks the current value of this parameter in `/etc/audit/auditd.conf`. The remediation script modifies this setting to the desired action and restarts the auditd service. The recommended states provide a tiered approach to this critical response. 'Basic' (`SYSLOG`) ensures notification without impacting system availability. 'Moderate' (`SINGLE`) takes a stronger step by dropping the system to single-user mode, preventing further user activity while allowing administrative intervention. 'Strict' (`HALT`) provides the highest level of security by shutting down the system entirely, guaranteeing that no auditable event can occur without being logged. This is the recommended state for high-security environments where the completeness of the audit log is paramount.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['SYSLOG']` |
| **Moderate** | `['SINGLE']` |
| **Strict** | `['HALT']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the `/etc/audit/auditd.conf` file for the value of the `admin_space_left_action` parameter. The script must output only the value, with no extra text or labels.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired state for the `admin_space_left_action` parameter in `/etc/audit/auditd.conf`. The script should update the configuration file with the provided value and restart the auditd service to apply the change. It must return `true` on success and `false` on failure.

