# Ensure rsyslog is installed

Necessity: The rsyslog service is the standard system logging daemon responsible for collecting, processing, and forwarding log messages from various sources on a system. Without rsyslog, there is no centralized mechanism to record critical system events, security incidents, application errors, or user activities. This lack of visibility severely hampers security monitoring, incident response, forensic analysis, and troubleshooting, creating a significant security risk.

Auditing and Remediation: The audit script verifies whether the rsyslog package is installed on the system, which is the first step in ensuring a functional logging infrastructure. The remediation script installs the rsyslog package using the native package manager if it is found to be missing, thereby establishing the foundation for system logging.

Recommended State Rationale: 
Basic, Moderate, and Strict: All security levels mandate that rsyslog be 'Installed'. System logging is a foundational security control, not a graded one. Its absence represents a critical failure in system visibility. For any level of security hardening, from basic to strict, the presence of a logging daemon is non-negotiable. While subsequent rules will govern the *configuration* of rsyslog (e.g., log forwarding, file permissions), the prerequisite is its installation.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Installed']` |
| **Moderate** | `['Installed']` |
| **Strict** | `['Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks if the rsyslog package is installed using the system's package manager. The script must return the string 'Installed' if the package is present, and 'Not Installed' if it is not. The output should not contain any other text, labels, or formatting.

## Remediation Script Working

bash script that accepts one positional command-line argument representing the desired state. If the argument is the string 'Installed', the script must use the system's package manager (yum or dnf) to install the rsyslog package. The script must return 'true' upon successful installation or if the package was already installed, and 'false' on failure. The script should perform no action for any other argument.

