<def-group>
  <definition class="compliance" id="rsyslog_remote_loghost" version="1">
    <metadata>
      <title>Send Logs to a Remote Loghost</title>
      <affected family="unix">
        <platform>Red Hat Enterprise Linux 6</platform>
      </affected>
      <description>Syslog logs should be sent to a remote loghost</description>
      <reference source="SDW" ref_id="20131025" ref_url="test_attestation" />
    </metadata>
    <criteria operator="OR">
      <criterion comment="Remote logging set within /etc/rsyslog.conf" test_ref="test_remote_rsyslog_conf" />
      <criterion comment="Remote logging set within /etc/rsyslog.d" test_ref="test_remote_rsyslog_d" />
    </criteria>
  </definition>

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="Ensures system configured to export logs to remote host"
  id="test_remote_rsyslog_conf" version="1">
    <ind:object object_ref="object_remote_loghost_rsyslog_conf" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="Ensures system configured to export logs to remote host"
  id="test_remote_rsyslog_d" version="1">
    <ind:object object_ref="object_remote_loghost_rsyslog_d" />
  </ind:textfilecontent54_test>
  
  <ind:textfilecontent54_object id="object_remote_loghost_rsyslog_conf" version="1">
    <ind:filepath>/etc/rsyslog.conf</ind:filepath>
    <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_object id="object_remote_loghost_rsyslog_d" version="1">
    <ind:path>/etc/rsyslog.d</ind:path>
    <ind:filename operation="pattern match">.*</ind:filename>
    <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

</def-group>
