# Ensure audit log storage size is configured

Necessity: Configuring the audit log storage size (`max_log_file`) is critical for ensuring system stability and maintaining a security audit trail. Without a defined limit, audit logs could grow indefinitely, consuming all available disk space and causing a denial-of-service condition that could halt the entire system. Conversely, a size that is too small may cause important audit events to be overwritten too quickly, impeding forensic investigations. This setting balances log retention with resource management.

Auditing and Remediation: The audit script directly inspects the `/etc/audit/auditd.conf` configuration file to verify the current value of the `max_log_file` parameter. The remediation script modifies this file, setting `max_log_file` to a specified value (in megabytes) to control the maximum size of a single audit log file before it is rotated.

Recommended State Rationale:
- Basic: `[100, 100]` sets a 100 MB limit. This is a foundational value suitable for systems with limited disk space, ensuring that logging does not cause system instability while retaining a reasonable amount of data.
- Moderate: `[500, 500]` increases the limit to 500 MB. This is recommended for standard production servers, allowing for longer retention of audit data before rotation, which is beneficial for routine monitoring and short-term incident analysis.
- Strict: `[1024, 'upper bound']` sets a minimum size of 1 GB. This is aligned with security best practices (e.g., CIS benchmarks) for high-security environments. A larger log file size is crucial for retaining a comprehensive audit trail over extended periods, which is essential for detailed forensic analysis and meeting stringent compliance requirements. The upper bound is determined by the available disk space and organizational retention policies.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[100, 'upper bound']` |
| **Moderate** | `[500, 'upper bound']` |
| **Strict** | `[1024, 'upper bound']` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that queries the `/etc/audit/auditd.conf` file. The script must parse the file to find the line containing `max_log_file` and return only the numeric value assigned to it, with no extra text or labels.

## Remediation Script Working

Bash script that accepts a single numeric value as a direct, positional command-line argument. The script must use this value to set the `max_log_file` parameter in `/etc/audit/auditd.conf`. If the setting is successfully updated, the script must return `true`; otherwise, it must return `false`.

