# Ensure rsyslog logging is configured

The `rsyslog` service is the standard system logger for many Linux distributions, including Ubuntu. Its primary function is to collect, process, and forward log messages from the kernel, services, and applications. Having a centralized logging mechanism is a foundational requirement for security, operational visibility, and compliance. Without `rsyslog` or a similar service, there would be no persistent record of system events, making it nearly impossible to perform forensic analysis after a security incident, troubleshoot system failures, or audit user activity. A misconfiguration, such as the service being disabled or uninstalled, creates a critical blind spot that attackers can exploit to cover their tracks. The audit script verifies the installation status and service state of `rsyslog`. The remediation script ensures the service is installed and enabled as required. For all security levels—Basic, Moderate, and Strict—the recommended state is 'Enabled'. This is because system logging is a non-negotiable, fundamental control. While stricter security postures would involve configuring `rsyslog` to forward logs to a secure, remote SIEM, the local service must first be running. Therefore, there is no lesser acceptable state for the service itself.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the `rsyslog` service. The script should determine if the `rsyslog` package is installed and if the service is enabled. It must return one of three possible strings exclusively: 'Enabled' if the package is installed and the service is enabled, 'Disabled' if the package is installed but the service is not enabled, or 'Not Installed' if the package is not present on the system. The output should not contain any other text or formatting.

## Remediation Script Working

Bash script that accepts a single positional command-line argument to configure the `rsyslog` service. The argument must be one of the following strings: 'Enabled', 'Disabled', or 'Not Installed'. If the argument is 'Enabled', the script must install the `rsyslog` package (if not already present) and enable the service to start on boot. If the argument is 'Disabled', the script must disable the service. If the argument is 'Not Installed', it must purge the `rsyslog` package from the system. The script must return the string 'true' upon successful completion of the requested action and 'false' if any error occurs.

