CCE-26801-1 - rsyslog suggestion/question
wm-lists
wm-lists at nixpeeps.com
Fri Oct 25 11:46:52 UTC 2013
It appears the requirement check /etc/rsyslog.conf for an entry such as
*.* @*loghost.example.com*
or
*.* @@*loghost.example.com*
<ind:textfilecontent54_object id="oval:ssg:obj:1907" version="1">
<ind:path>/etc</ind:path>
<ind:filename>rsyslog.conf</ind:filename>
<ind:pattern operation="pattern
match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
However in my case, we utilize multiple .conf files under /etc/rsyslog.d
for destinations (log aggregators, etc...)
I'm guessing the scap software doesn't follow include Directives?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131025/a0a668ee/attachment.html>
More information about the scap-security-guide
mailing list