# Ensure journald service is enabled and active

Necessity: The systemd-journald service is the core component for log collection and management on modern Linux systems. It gathers data from the kernel, system services, daemons, and applications into a centralized, structured journal. Disabling this service effectively blinds system administrators and security tools, making it impossible to perform troubleshooting, conduct security audits, or investigate incidents. An inactive logging service is a critical security risk as it prevents the detection of unauthorized access, malware activity, or system failures. Auditing and Remediation: The audit script verifies the status of the systemd-journald service, checking that it is both configured to start on boot ('enabled') and is currently running ('active'). The remediation script ensures the service is properly configured and started using the 'systemctl enable --now' command, which both enables it for future boots and starts it immediately. Recommended State Rationale: Basic, Moderate, and Strict levels all recommend the state 'Enabled and Active'. This is a foundational, non-negotiable security setting. There is no acceptable scenario in a production environment where system logging should be disabled. Unlike tunable parameters, the status of the journald service is binary; it must be active for the system to be considered secure and manageable. Therefore, all security postures mandate that this service is running.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled and Active']` |
| **Moderate** | `['Enabled and Active']` |
| **Strict** | `['Enabled and Active']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'systemd-journald' service is both enabled and currently active. The script must output only the string 'Enabled and Active' if both conditions are met, or 'Not Enabled or Inactive' otherwise, with no extra text or labels.

## Remediation Script Working

Bash script that accepts one positional argument for the desired state. If the argument is 'Enabled and Active', the script must enable and start the 'systemd-journald' service. The script must output 'true' on success and 'false' on failure.

