# Ensure journald is configured to send logs to rsyslog

Necessity: The `journald` service is the native logging component of `systemd`, while `rsyslog` is a long-standing and powerful syslog daemon used for log processing and forwarding. Forwarding logs from `journald` to `rsyslog` is critical for ensuring that all system logs are consolidated into a single, manageable stream. This allows for centralized log collection, long-term archival, and integration with Security Information and Event Management (SIEM) systems. Failure to do so creates a log visibility gap, as events captured only by `journald` would be missed by traditional log analysis infrastructure, hindering security monitoring and incident response.

Auditing and Remediation: The audit script verifies the system's configuration by checking the `ForwardToSyslog` parameter within the `/etc/systemd/journald.conf` file. The remediation script directly modifies this file to set the `ForwardToSyslog` parameter to 'yes', ensuring that the setting is explicitly enabled, and then restarts the `systemd-journald` service to activate the change.

Recommended State Rationale: 
- Basic: ['yes']. This is the essential configuration for any system where centralized logging is in place. It ensures that modern `systemd` logs are not siloed and are properly integrated with the established `rsyslog` infrastructure.
- Moderate: ['yes']. For environments with a moderate security posture, enabling this setting is a non-negotiable best practice. There is no effective intermediate state; logging must be comprehensive.
- Strict: ['yes']. In a high-security environment, complete and uninterrupted log collection is paramount. Ensuring `journald` forwards all logs to `rsyslog` is the only acceptable configuration to maintain full security visibility and compliance.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['yes']` |
| **Moderate** | `['yes']` |
| **Strict** | `['yes']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the `/etc/systemd/journald.conf` file. The script must parse this file to find the value of the `ForwardToSyslog` setting. If the line is present and not commented out, it should return its value (e.g., 'yes' or 'no'). If the setting is commented out or absent, the script should return 'yes' as this is the system's default behavior. The script must only output the final value with no extra text.

## Remediation Script Working

Bash script that takes a single positional argument (e.g., 'yes' or 'no') to configure the `ForwardToSyslog` setting in `/etc/systemd/journald.conf`. The script should locate the `ForwardToSyslog` line, uncomment it if necessary, and set its value to the provided argument. If the line does not exist, the script must add it under the `[Journal]` section. After applying the change, the script should restart the `systemd-journald` service to apply the configuration. The script must return `true` upon successful modification and service restart, and `false` otherwise.

