# Ensure separate partition exists for /var/log

Necessity: Isolating /var/log onto its own partition is a critical security and stability measure. It prevents excessive log generation from filling up the root filesystem, which could lead to a system-wide denial-of-service condition, making the system unstable or unable to boot. Separating this directory also allows for applying specific, more restrictive mount options to the partition (such as 'nodev', 'nosuid', and 'noexec'), further hardening the system by preventing the execution of unauthorized programs from a location where logs are written. Auditing and Remediation: The audit script verifies if '/var/log' is configured as a distinct mount point in the system's mount table. Remediation is a complex manual process that involves repartitioning disks, creating a new filesystem, moving existing log data, and permanently configuring the new mount in '/etc/fstab'. It is not suitable for automation. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'Mounted'. This is a foundational configuration requirement according to security benchmarks like CIS. There is no middle ground for this setting; the partition is either separate, providing the intended security and stability benefits, or it is not. Therefore, all security levels mandate this configuration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Mounted']` |
| **Moderate** | `['Mounted']` |
| **Strict** | `['Mounted']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that checks if '/var/log' is a separate mount point. The script should use a command like 'findmnt --noheadings --output=SOURCE /var/log' and verify that the output is not the same as the source for the root filesystem ('/'). The script must return only the string 'Mounted' if it is a separate partition, or 'Not Mounted' if it is not.

## Remediation Script Working

Automated remediation for creating a separate partition is not feasible or safe as it requires manual intervention, including disk partitioning, data migration, and updating the filesystem table (/etc/fstab). Therefore, a remediation script should not attempt to perform this action. The script must be designed to recognize it cannot perform the action and should always return 'false' to indicate failure and the need for manual administrator intervention.

