<div dir="ltr"><span style="font-family:arial,sans-serif;font-size:13px">It appears the requirement check /etc/rsyslog.conf for an entry such as </span><div style="font-family:arial,sans-serif;font-size:13px"><br></div><div style="font-family:arial,sans-serif;font-size:13px">
<pre style="white-space:pre-wrap;overflow:auto;background-color:rgb(204,204,204);padding:0.2em"><code>*.* @<em><a href="http://loghost.example.com/" target="_blank">loghost.example.com</a></em></code></pre>or<br><pre style="white-space:pre-wrap;overflow:auto;background-color:rgb(204,204,204);padding:0.2em">
<code>*.* @@<em><a href="http://loghost.example.com/" target="_blank">loghost.example.com</a></em></code></pre><div><br></div><div><div> <ind:textfilecontent54_object id="oval:ssg:obj:1907" version="1"></div>
<div> <ind:path>/etc</ind:path></div><div> <ind:filename>rsyslog.conf</ind:filename></div><div> <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern></div>
<div> <ind:instance datatype="int">1</ind:instance></div><div> </ind:textfilecontent54_object></div></div><div><br></div><div><br></div><div>However in my case, we utilize multiple .conf files under /etc/rsyslog.d for destinations (log aggregators, etc...)</div>
<div><br></div><div>I'm guessing the scap software doesn't follow include Directives? </div></div></div>