# Ensure only one logging system is in use

Necessity: Modern Ubuntu systems use `systemd-journald` as the primary logging daemon. Running additional logging services like `rsyslog` or `syslog-ng` simultaneously creates redundancy, consumes unnecessary system resources (CPU, disk I/O, storage), and complicates log management and analysis. Consolidating to a single logging service ensures a consistent and efficient logging environment, which is crucial for security monitoring and incident response.

Auditing and Remediation: The audit script checks if the `rsyslog` service is active, as it is a common legacy logging daemon that might be running alongside `systemd-journald`. The remediation script rectifies this by stopping and disabling the `rsyslog` service, thereby designating `systemd-journald` as the sole system logger.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'disabled'. This is a binary security measure with no intermediate states. Having a secondary logging system active is inefficient and non-compliant with security best practices that advocate for minimizing the system's attack surface and operational complexity. Therefore, the only secure and recommended configuration is to disable any redundant logging services.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled']` |
| **Strict** | `['disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script to check if the `rsyslog` service is active. The script must return the string 'enabled' if the service is active, and 'disabled' if it is not. The output must contain only the status string, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts one positional argument ('disabled'). If the argument is 'disabled', the script must stop and disable the `rsyslog` service using `systemctl`. The script must return `true` on success and `false` on failure.

