# Ensure audit_backlog_limit is sufficient

The 'audit_backlog_limit' specifies the number of outstanding audit buffers allowed in the kernel. This buffer holds audit events when the audit daemon (auditd) cannot write them to disk quickly enough. If this limit is exceeded during a high-volume event period, the kernel will drop new audit records, leading to a loss of security visibility. An insufficient limit could allow an attacker's activities to go unrecorded.

The audit script verifies the currently configured backlog limit by querying the active audit subsystem settings. The remediation script modifies the audit rules file to set a new limit and reloads the rules to make the change effective, ensuring the configuration persists across reboots.

- **Basic [8192, 8192]:** This value is recommended by security benchmarks like CIS for RHEL/CentOS. It provides a sufficient buffer for most systems under normal load to prevent the loss of audit events.
- **Moderate [16384, 16384]:** A larger buffer is recommended for systems that generate a higher volume of audit events, such as busy web servers or database servers, providing an increased safety margin against event loss during activity spikes.
- **Strict [32768, 'upper bound']:** This setting is for highly critical systems where any loss of audit data is unacceptable. A very large backlog limit ensures maximum resilience against event loss, even under sustained high loads or when the audit daemon is temporarily unresponsive.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[8192, 'upper bound']` |
| **Moderate** | `[16384, 'upper bound']` |
| **Strict** | `[32768, 'upper bound']` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that checks the current audit backlog limit. The script should execute the command 'auditctl -s' and parse the output to find the value associated with 'backlog_limit'. The script must output only the numeric value of the limit.

## Remediation Script Working

Bash script that accepts a single numeric value as a command-line argument to set the audit backlog limit. The script should find the line starting with '-b' or '--backlog' in the '/etc/audit/rules.d/audit.rules' file (or create it if it doesn't exist) and update it with the provided value. After modifying the file, the script must run 'augenrules --load' to apply the new configuration. The script must output 'true' on success and 'false' on failure.

