# Ensure the running and on disk configuration is the same

Necessity: It is critical that the running auditd configuration matches the on-disk configuration to ensure logging integrity and persistence. A mismatch can occur if on-disk rules are updated but not loaded, or if an administrator or attacker manually alters the running rules without making a persistent change. This discrepancy creates a security blind spot, as the system will not be logging events according to the defined policy, potentially allowing malicious activity to go undetected. Ensuring they are synchronized guarantees that the intended audit policy is active and will persist across reboots.

Auditing and Remediation: The audit script uses the `augenrules --check` command, which is the standard utility for comparing the rules defined in `/etc/audit/rules.d/` with those currently loaded into the kernel. It provides a direct and reliable way to detect configuration drift. The remediation script uses `augenrules --load`, which reads all rule files from disk, compiles them, and overwrites the current in-memory rules, thereby forcing the running configuration to match the persistent one.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'same'. There is no acceptable security scenario where the active audit policy should deviate from the intended, on-disk policy. A 'different' state indicates a misconfiguration or a potential compromise, regardless of the overall security hardening level. Therefore, maintaining synchronization is a foundational requirement for a reliable and effective auditing system at all levels of security.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['same']` |
| **Moderate** | `['same']` |
| **Strict** | `['same']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that executes `augenrules --check`. If the command's exit code is 0, the script must output the string 'same'. If the exit code is 1 or greater, it must output 'different'. The script's output must consist solely of one of these two strings, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument. If the argument is the string 'same', the script must execute the `augenrules --load` command to synchronize the running audit configuration with the rules on disk. The script must output `true` if the load command succeeds (exit code 0), and `false` if it fails. If the provided argument is not 'same', the script should do nothing and output `false`.

