# Ensure rsyslog is configured to send logs to a remote log host

Necessity: Centralized logging is a foundational security practice. It ensures that system logs are sent to a separate, secure location, protecting them from alteration or deletion by an attacker who compromises the source system. This preserved audit trail is critical for security monitoring, incident detection, forensic analysis, and regulatory compliance. Without remote logging, an attacker can erase their tracks, making it nearly impossible to understand the scope and method of a breach.

Auditing and Remediation: The audit script inspects the rsyslog configuration files (`/etc/rsyslog.conf` and `/etc/rsyslog.d/*.conf`) to determine if a rule exists to forward all log messages (`*.*`) to a remote destination. The remediation script creates a new configuration file to add this forwarding rule, pointing to a specified remote server, and then restarts the rsyslog service to apply the new configuration.

Recommended State Rationale: The state is 'Enabled' across all levels, but the implementation details define the security posture. 
- Basic: Recommends enabling log forwarding using UDP (`*.* @remote-host`). This is the simplest method but is unreliable as it does not guarantee message delivery. 
- Moderate: Recommends using TCP (`*.* @@remote-host`) for log forwarding. TCP ensures that log messages are delivered reliably and in the correct order, preventing the loss of critical security events during transit. 
- Strict: Recommends forwarding logs over a TLS-encrypted TCP connection. This provides confidentiality and integrity, preventing eavesdropping or tampering with log data as it traverses the network. This is the most secure method and is essential for protecting sensitive information within logs and meeting stringent compliance requirements.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that searches all rsyslog configuration files (e.g., `/etc/rsyslog.conf` and files in `/etc/rsyslog.d/`) for a line that forwards all logs to a remote host (e.g., starting with `*.* @` or `*.* @@`). The script should output the first matching configuration line found, or an empty string if no such line exists. The output must contain only the configuration line itself, with no extra text or labels.

## Remediation Script Working

Bash script that takes a single positional command-line argument representing the remote log host destination (e.g., '@@loghost.example.com:514'). The script should create a new configuration file (e.g., `/etc/rsyslog.d/99-remote.conf`), add a line in the format `*.* [argument]` to it, and then restart the rsyslog service. The script must output 'true' if the operation is successful and 'false' otherwise.

