# Ensure only one logging system is in use

Necessity: Modern CentOS systems utilize 'systemd-journald' for logging by default. Running a second logging daemon, such as 'rsyslog', creates redundancy, increases the system's attack surface, and complicates log management and analysis. A misconfiguration could lead to inconsistent log data, duplicated entries, or even lost events. Consolidating to a single logging service simplifies administration, reduces resource consumption, and ensures a single, authoritative source for system event data, which is critical for security auditing and incident response.

Auditing and Remediation: The audit script verifies whether the 'rsyslog' package is installed, which is the most common redundant logging service found alongside 'systemd-journald'. The remediation script addresses this by uninstalling the 'rsyslog' package, thereby enforcing 'systemd-journald' as the sole system logger.

Recommended State Rationale: The recommendation for all security levels (Basic, Moderate, and Strict) is to have 'rsyslog' 'Not Installed'. This is a foundational best practice rather than a tunable parameter. There is no security benefit to running redundant local logging daemons. The Basic level enforces this best practice for simplicity and security. The Moderate and Strict levels maintain this configuration as it aligns with security benchmarks (e.g., CIS) that advocate for minimizing the software footprint and disabling unnecessary services.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'rsyslog' package is installed. The script should output 'Installed' if the package is present and 'Not Installed' if it is not. The output must contain only this string.

## Remediation Script Working

Bash script that accepts a single positional argument, which is the desired state ('Not Installed'). If the argument is 'Not Installed', the script must use the system's package manager (e.g., 'yum' or 'dnf') to remove the 'rsyslog' package. The script must return 'true' on successful removal or if the package was already absent, and 'false' on failure.

