[PATCH] Guide refers to :omrelp: as a valid remote logging option, so I've updated the check to accept that format as well

Maura Dailey maura at eclipse.ncsc.mil
Mon Aug 19 17:03:46 UTC 2013


Signed-off-by: Maura Dailey <maura at eclipse.ncsc.mil>
---
 RHEL6/input/checks/rsyslog_remote_loghost.xml |   20 +++++++-------------
 1 files changed, 7 insertions(+), 13 deletions(-)

diff --git a/RHEL6/input/checks/rsyslog_remote_loghost.xml b/RHEL6/input/checks/rsyslog_remote_loghost.xml
index b3ab6a8..81441eb 100644
--- a/RHEL6/input/checks/rsyslog_remote_loghost.xml
+++ b/RHEL6/input/checks/rsyslog_remote_loghost.xml
@@ -1,30 +1,24 @@
 <def-group>
-  <definition class="compliance"
-  id="rsyslog_remote_loghost" version="1">
+  <definition class="compliance" id="rsyslog_remote_loghost" version="1">
     <metadata>
       <title>Send Logs to a Remote Loghost</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>Syslog logs should be sent to a remote
-      loghost</description>
+      <description>Syslog logs should be sent to a remote loghost</description>
+      <reference source="MED" ref_id="20130819" ref_url="test_attestation" />
     </metadata>
     <criteria>
-      <criterion comment="Conditions are satisfied"
-      test_ref="test_rsyslog_remote_loghost" />
+      <criterion comment="Conditions are satisfied" test_ref="test_rsyslog_remote_loghost" />
     </criteria>
   </definition>
-  <ind:textfilecontent54_test check="all"
-  check_existence="all_exist"
-  comment="Tests the value of the \*\.\*[\s]+@ setting in the /etc/syslog.conf file"
-  id="test_rsyslog_remote_loghost" version="1">
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the \*\.\*[\s]+@ setting in the /etc/syslog.conf file" id="test_rsyslog_remote_loghost" version="1">
     <ind:object object_ref="object_rsyslog_remote_loghost" />
   </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="object_rsyslog_remote_loghost"
-  version="1">
+  <ind:textfilecontent54_object id="object_rsyslog_remote_loghost" version="1">
     <ind:path>/etc</ind:path>
     <ind:filename>rsyslog.conf</ind:filename>
-    <ind:pattern operation="pattern match">^\*\.\*[\s]+@</ind:pattern>
+    <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 </def-group>
-- 
1.7.1



More information about the scap-security-guide mailing list