# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low

- name: "Put contents into /etc/audit/rules.d/10-base-config.rules according to policy"
  ansible.builtin.copy:
    dest: "/etc/audit/rules.d/10-base-config.rules"
    content: |+
        ## First rule - delete all
        -D

        ## Increase the buffers to survive stress events.
        ## Make this bigger for busy systems
        -b 8192

        ## This determine how long to wait in burst of events
        --backlog_wait_time 60000

        ## Set failure mode to syslog
        -f 1

    force: yes

- name: Configure basic parameters of Audit system - Remove any permissions from group and other
  ansible.builtin.file:
    path: /etc/audit/rules.d/10-base-config.rules
    mode: g-rwx,o-rwx
    state: touch