# Ensure journald log file rotation is configured

Necessity: Configuring journald log file rotation is critical for maintaining system stability and availability. Without explicit limits, system logs can grow indefinitely, eventually consuming all available disk space on the partition where they are stored (typically the root filesystem). This can lead to a denial-of-service condition, causing the system to crash or critical applications to fail. Enforcing size limits ensures predictable disk usage and implements a basic log retention policy. Auditing and Remediation: The audit script checks the 'SystemMaxUse' parameter in '/etc/systemd/journald.conf' to determine the maximum disk space the journal is allowed to use. This provides visibility into the current log rotation policy. The remediation script configures this same parameter, allowing an administrator to enforce a specific size limit, thereby preventing uncontrolled log growth and ensuring system resources are preserved. Recommended State Rationale: Basic ('500M'): This level establishes a conservative limit suitable for systems with limited disk space or non-critical workloads. It prevents disk exhaustion while retaining sufficient logs for recent troubleshooting. Moderate ('1G'): This is a balanced recommendation for most production servers, providing a larger buffer for log retention (weeks or months) which is useful for operational monitoring and routine security analysis without posing a significant risk to disk capacity. Strict ('4G'): This level is recommended for high-security systems, log hosts, or environments under strict compliance regulations (e.g., PCI-DSS, HIPAA) that require long-term log retention. 4GB is the maximum default cap used by journald and provides an extensive historical record crucial for in-depth forensic investigations and trend analysis.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['500M']` |
| **Moderate** | `['1G']` |
| **Strict** | `['4G']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the '/etc/systemd/journald.conf' file for the value of the 'SystemMaxUse' setting. The script should parse the file, find the active (uncommented) 'SystemMaxUse' line, and output only its value (e.g., '1G'). If the setting is not explicitly configured, the script should return the string 'default'.

## Remediation Script Working

Bash script that accepts a single string argument specifying the desired maximum disk space for journal files (e.g., '500M'). The script must locate the 'SystemMaxUse' setting in '/etc/systemd/journald.conf', uncomment it if necessary, and set its value to the provided argument. If the setting does not exist, it should be added under the '[Journal]' section. The script must return 'true' upon successful modification and 'false' if an error occurs.

