# Ensure rsyslog service is enabled and active

Necessity: The rsyslog service is the standard system logging daemon for CentOS. It is responsible for collecting log messages from the kernel, system processes, and applications. These logs are indispensable for security monitoring, incident investigation, system troubleshooting, and regulatory compliance. Disabling rsyslog effectively blinds administrators to system activity, making it nearly impossible to detect unauthorized access, diagnose failures, or investigate security breaches. The risk of not running a logging service is a complete loss of operational and security visibility.

Auditing and Remediation: The audit script verifies the operational status of the rsyslog service by checking if it is both 'active' (currently running) and 'enabled' (configured to start automatically on boot) using systemctl commands. The remediation script uses systemctl to change the service's state, either enabling and starting it to ensure logging is active, or disabling and stopping it if required.

Recommended State Rationale: 
Basic: ['enabled'] - Having the system logging service active is a fundamental security and operational requirement. This is the minimum baseline for any server.
Moderate: ['enabled'] - There is no effective intermediate state for system logging. For any moderate security posture, the service must be running to ensure events are recorded.
Strict: ['enabled'] - In a strict security environment, comprehensive logging is non-negotiable. While a strict configuration would also involve forwarding logs to a secure, remote, and immutable log aggregator, the foundational step on the local machine is to ensure the rsyslog service is running. Therefore, 'enabled' is the only acceptable state across all security levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'rsyslog' service is both enabled and active. The script must output 'enabled' if both conditions are met, and 'disabled' otherwise. The output must be only the status string ('enabled' or 'disabled') with no extra text or labels.

## Remediation Script Working

Bash script that accepts a single positional argument: 'enabled' or 'disabled'. If the argument is 'enabled', the script must enable and start the 'rsyslog' service. If 'disabled', it must stop and disable the service. The script must return 'true' on success and 'false' on failure.

