# Ensure audit logs are not automatically deleted

The `max_log_file_action` parameter in the auditd configuration determines the action the system takes when the audit log files reach their maximum configured size. Properly configuring this setting is critical for ensuring the integrity and availability of audit logs, which are essential for forensic analysis, intrusion detection, and accountability. A misconfiguration could lead to the automatic deletion of crucial security event data, potentially allowing an attacker to cover their tracks.

The audit script checks the current value of the `max_log_file_action` setting in `/etc/audit/auditd.conf`. The remediation script modifies this setting to a specified value and restarts the auditd service to ensure the new configuration takes effect.

- **Basic (`['keep_logs']`):** This state, recommended by CIS benchmarks, ensures that audit logs are never automatically overwritten or deleted when the disk space limit is reached. Instead, logging for new events will fail until an administrator manually archives the old logs and frees up space. This prioritizes log preservation over continuous system operation.
- **Moderate (`['suspend']`):** This state provides a more forceful notification by suspending the audit daemon entirely when log space is full. This stops all new audit record generation, effectively alerting administrators that immediate action is required to resolve the disk space issue, as the system is now operating without an audit trail.
- **Strict (`['halt']`):** This is the most secure configuration, suitable for high-security environments. It halts the entire system if an audit record cannot be written. This approach ensures that no action can be performed on the system without being logged, prioritizing data integrity and accountability above all else, including system availability.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['keep_logs']` |
| **Moderate** | `['suspend']` |
| **Strict** | `['halt']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that reads the `/etc/audit/auditd.conf` file and extracts the value of the `max_log_file_action` setting. The script must output only the value itself (e.g., `keep_logs`) without any surrounding text or labels.

## Remediation Script Working

Bash script that accepts one positional command-line argument, which is the desired value for the `max_log_file_action` setting. The script should modify the `/etc/audit/auditd.conf` file, setting `max_log_file_action` to the provided value. If the setting does not exist, it should be added. The script must restart the auditd service to apply the changes and return `true` on success or `false` on failure.

