Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil>
---
RHEL6/input/checks/rsyslog_remote_loghost.xml | 20 +++++++-------------
1 files changed, 7 insertions(+), 13 deletions(-)
diff --git a/RHEL6/input/checks/rsyslog_remote_loghost.xml
b/RHEL6/input/checks/rsyslog_remote_loghost.xml
index b3ab6a8..81441eb 100644
--- a/RHEL6/input/checks/rsyslog_remote_loghost.xml
+++ b/RHEL6/input/checks/rsyslog_remote_loghost.xml
@@ -1,30 +1,24 @@
<def-group>
- <definition class="compliance"
- id="rsyslog_remote_loghost" version="1">
+ <definition class="compliance" id="rsyslog_remote_loghost"
version="1">
<metadata>
<title>Send Logs to a Remote Loghost</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>Syslog logs should be sent to a remote
- loghost</description>
+ <description>Syslog logs should be sent to a remote
loghost</description>
+ <reference source="MED" ref_id="20130819"
ref_url="test_attestation" />
</metadata>
<criteria>
- <criterion comment="Conditions are satisfied"
- test_ref="test_rsyslog_remote_loghost" />
+ <criterion comment="Conditions are satisfied"
test_ref="test_rsyslog_remote_loghost" />
</criteria>
</definition>
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist"
- comment="Tests the value of the \*\.\*[\s]+@ setting in the /etc/syslog.conf
file"
- id="test_rsyslog_remote_loghost" version="1">
+ <ind:textfilecontent54_test check="all"
check_existence="all_exist" comment="Tests the value of the \*\.\*[\s]+@
setting in the /etc/syslog.conf file" id="test_rsyslog_remote_loghost"
version="1">
<ind:object object_ref="object_rsyslog_remote_loghost" />
</ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_rsyslog_remote_loghost"
- version="1">
+ <ind:textfilecontent54_object id="object_rsyslog_remote_loghost"
version="1">
<ind:path>/etc</ind:path>
<ind:filename>rsyslog.conf</ind:filename>
- <ind:pattern operation="pattern
match">^\*\.\*[\s]+@</ind:pattern>
+ <ind:pattern operation="pattern
match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
--
1.7.1
Show replies by date