[PATCH] Guide refers to :omrelp: as a valid remote logging option, so I've updated the check to accept that format as well

[Maura Dailey]

Signed-off-by: Maura Dailey 
---
 RHEL6/input/checks/rsyslog_remote_loghost.xml |   20 +++++++-------------
 1 files changed, 7 insertions(+), 13 deletions(-)

diff --git a/RHEL6/input/checks/rsyslog_remote_loghost.xml b/RHEL6/input/checks/rsyslog_remote_loghost.xml
index b3ab6a8..81441eb 100644
--- a/RHEL6/input/checks/rsyslog_remote_loghost.xml
+++ b/RHEL6/input/checks/rsyslog_remote_loghost.xml
@@ -1,30 +1,24 @@
 <def-group>
-  <definition class="compliance"
-  id="rsyslog_remote_loghost" version="1">
+  <definition class="compliance" id="rsyslog_remote_loghost" version="1">
     <metadata>
       <title>Send Logs to a Remote Loghost</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>Syslog logs should be sent to a remote
-      loghost</description>
+      <description>Syslog logs should be sent to a remote loghost</description>
+      <reference source="MED" ref_id="20130819" ref_url="test_attestation" />
     </metadata>
     <criteria>
-      <criterion comment="Conditions are satisfied"
-      test_ref="test_rsyslog_remote_loghost" />
+      <criterion comment="Conditions are satisfied" test_ref="test_rsyslog_remote_loghost" />
     </criteria>
   </definition>
-  <ind:textfilecontent54_test check="all"
-  check_existence="all_exist"
-  comment="Tests the value of the *.*[\s]+@ setting in the /etc/syslog.conf file"
-  id="test_rsyslog_remote_loghost" version="1">
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the *.*[\s]+@ setting in the /etc/syslog.conf file" id="test_rsyslog_remote_loghost" version="1">
     <ind:object object_ref="object_rsyslog_remote_loghost" />
   </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="object_rsyslog_remote_loghost"
-  version="1">
+  <ind:textfilecontent54_object id="object_rsyslog_remote_loghost" version="1">
     ind:path/etc</ind:path>
     ind:filenamersyslog.conf</ind:filename>
-    <ind:pattern operation="pattern match">^*.*[\s]+@</ind:pattern>
+    <ind:pattern operation="pattern match">^*.*[\s]+(?:@|:omrelp:)</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 </def-group>

[Jeffrey Blank]

This batch of 3 (this, UDPServerRun, sha512) all look good to me.

Please push.

On 08/19/2013 01:03 PM, Maura Dailey wrote:
> Signed-off-by: Maura Dailey
>
> RHEL6/input/checks/rsyslog_remote_loghost.xml |   20 +++++++-------------
>  1 files changed, 7 insertions(+), 13 deletions(-)
>
> diff --git a/RHEL6/input/checks/rsyslog_remote_loghost.xml b/RHEL6/input/checks/rsyslog_remote_loghost.xml
> index b3ab6a8..81441eb 100644
> --- a/RHEL6/input/checks/rsyslog_remote_loghost.xml
> +++ b/RHEL6/input/checks/rsyslog_remote_loghost.xml
> @@ -1,30 +1,24 @@
>
>  <def-group>
> -  <definition class="compliance"
> -  id="rsyslog_remote_loghost" version="1">
> +  <definition class="compliance" id="rsyslog_remote_loghost" version="1">
>      <metadata>
>        <title>Send Logs to a Remote Loghost</title>
>        <affected family="unix">
>          <platform>Red Hat Enterprise Linux 6</platform>
>        </affected>
> -      <description>Syslog logs should be sent to a remote
> -      loghost</description>
> +      <description>Syslog logs should be sent to a remote loghost</description>
> +      <reference source="MED" ref_id="20130819" ref_url="test_attestation" />
>      </metadata>
>      <criteria>
> -      <criterion comment="Conditions are satisfied"
> -      test_ref="test_rsyslog_remote_loghost" />
> +      <criterion comment="Conditions are satisfied" test_ref="test_rsyslog_remote_loghost" />
>      </criteria>
>    </definition>
> -  <ind:textfilecontent54_test check="all"
> -  check_existence="all_exist"
> -  comment="Tests the value of the \*\.\*[\s]+@ setting in the /etc/syslog.conf file"
> -  id="test_rsyslog_remote_loghost" version="1">
> +  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the \*\.\*[\s]+@ setting in the /etc/syslog.conf file" id="test_rsyslog_remote_loghost" version="1">
>      <ind:object object_ref="object_rsyslog_remote_loghost" />
>    </ind:textfilecontent54_test>
> -  <ind:textfilecontent54_object id="object_rsyslog_remote_loghost"
> -  version="1">
> +  <ind:textfilecontent54_object id="object_rsyslog_remote_loghost" version="1">
>      <ind:path>/etc</ind:path>
>      <ind:filename>rsyslog.conf</ind:filename>
> -    <ind:pattern operation="pattern match">^\*\.\*[\s]+@</ind:pattern>
> +    <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
>      <ind:instance datatype="int">1</ind:instance>
>    </ind:textfilecontent54_object>
>  </def-group>