# Ensure rsyslog service is enabled and active

The `rsyslog` service is fundamental to system security as it is responsible for collecting and storing log data from the operating system and applications. These logs are indispensable for security monitoring, troubleshooting, forensic analysis, and detecting unauthorized activities. Disabling this service creates a critical visibility gap, effectively blinding administrators to potential security breaches, system errors, or policy violations. An attacker's first step is often to disable logging to cover their tracks, making its continuous operation a non-negotiable security control. The audit script verifies the `rsyslog` service's status using `systemctl`, checking if it is both enabled to persist across reboots and currently active. The remediation script uses `systemctl` to unmask, enable, and start the service, ensuring it is properly configured. For this control, the Basic, Moderate, and Strict states are identical. The requirement is binary: the logging service must be running. Any state other than 'Enabled and Active' is unacceptable from a security perspective, as it fails to meet the baseline requirement for system auditing and monitoring.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled and Active']` |
| **Moderate** | `['Enabled and Active']` |
| **Strict** | `['Enabled and Active']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script to check the status of the `rsyslog` service. The script must query `systemd` to determine if the service is both enabled to start at boot (`systemctl is-enabled rsyslog`) and currently active (`systemctl is-active rsyslog`). The script must output a single, precise string value representing its state: 'Enabled and Active', 'Enabled but Inactive', 'Disabled', or 'Not Installed'. No other text or formatting should be included in the output.

## Remediation Script Working

Bash script that accepts one positional argument specifying the desired state for the `rsyslog` service. If the argument is 'Enabled and Active', the script must execute the necessary `systemctl` commands (`unmask`, `enable`, `start`) to configure the service. The script must conclude by returning the string 'true' upon successful configuration or 'false' if it fails to achieve the desired state.

