<def-group>
  <definition class="compliance"
  id="rsyslog_cron_logging" version="1">
    {{{ oval_metadata("Rsyslog should be configured to capture cron messages.") }}}
    <criteria operator="OR">
      <criterion comment="cron is configured in /etc/rsyslog.conf"
      test_ref="test_cron_logging_rsyslog" />
      <criterion comment="cron is configured in /etc/rsyslog.conf using RainerScript"
      test_ref="test_cron_logging_rsyslog_rainer" />
      <criterion comment="cron is configured in /etc/rsyslog.d"
      test_ref="test_cron_logging_rsyslog_dir" />
      <criterion comment="cron is configured in /etc/rsyslog.d using RainerScript"
      test_ref="test_cron_logging_rsyslog_dir_rainer" />
      {{% if "ol" in product %}}
      <criterion comment="rsyslog is configured in /etc/rsyslog.conf to log to all facilities"
      test_ref="test_cron_logging_rsyslog_logging_all_facilities" />
      <criterion comment="rsyslog is configured in /etc/rsyslog.d to log to all facilities"
      test_ref="test_cron_logging_rsyslog_dir_logging_all_facilities" />
      {{% endif %}}
    </criteria>
  </definition>

{{% set legacy_regex = "^[\\s]*cron\\.\\*[\\s]+/var/log/cron\\s*(?:#.*)?$" %}}
{{# RainerScript keys are case-insensitive #}}
{{% set rainer_script_regex = "(?m)^\\s*cron\\.\\*\\s+action\\(\\s*.*(?i)\\btype\\b(?-i)=\"omfile\"\\s*.*(?i)\\bfile\\b(?-i)=\"/var/log/cron\"\\s*.*\\)\\s*$" %}}

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="cron is configured in /etc/rsyslog.conf"
  id="test_cron_logging_rsyslog" version="1">
    <ind:object object_ref="obj_cron_logging_rsyslog" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_cron_logging_rsyslog" version="1">
    <ind:filepath>/etc/rsyslog.conf</ind:filepath>
    <ind:pattern operation="pattern match">{{{ legacy_regex }}}</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="cron is configured in /etc/rsyslog.conf using RainerScript"
  id="test_cron_logging_rsyslog_rainer" version="1">
    <ind:object object_ref="obj_cron_logging_rsyslog_rainer" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_cron_logging_rsyslog_rainer" version="1">
    <ind:filepath>/etc/rsyslog.conf</ind:filepath>
    <ind:pattern operation="pattern match">{{{ rainer_script_regex }}}</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="cron is configured in /etc/rsyslog.d"
  id="test_cron_logging_rsyslog_dir" version="1">
    <ind:object object_ref="obj_cron_logging_rsyslog_dir" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_cron_logging_rsyslog_dir" version="1">
    <ind:path>/etc/rsyslog.d</ind:path>
    <ind:filename operation="pattern match">^.*$</ind:filename>
    <ind:pattern operation="pattern match">{{{ legacy_regex }}}</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="cron is configured in /etc/rsyslog.d using RainerScript"
  id="test_cron_logging_rsyslog_dir_rainer" version="1">
    <ind:object object_ref="obj_cron_logging_rsyslog_dir_rainer" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_cron_logging_rsyslog_dir_rainer" version="1">
    <ind:path>/etc/rsyslog.d</ind:path>
    <ind:filename operation="pattern match">^.*$</ind:filename>
    <ind:pattern operation="pattern match">{{{ rainer_script_regex }}}</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  {{% if "ol" in product %}}
  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="rsyslog is configured in /etc/rsyslog.conf to log to all facilities"
  id="test_cron_logging_rsyslog_logging_all_facilities" version="1">
    <ind:object object_ref="obj_cron_logging_rsyslog_logging_all_facilities" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_cron_logging_rsyslog_logging_all_facilities" version="1">
    <ind:filepath>/etc/rsyslog.conf</ind:filepath>
    <ind:pattern operation="pattern match">(?m)^[\s]*\*\.\*[\s]+(/var/log/messages|action\(\s*.*(?i:\btype\b)="omfile"\s*.*(?i:\bfile\b)="/var/log/messages"\s*\))\s*(?:#.*)?$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="rsyslog is configured in /etc/rsyslog.d to log to all facilities"
  id="test_cron_logging_rsyslog_dir_logging_all_facilities" version="1">
    <ind:object object_ref="obj_cron_logging_rsyslog_dir_logging_all_facilities" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_cron_logging_rsyslog_dir_logging_all_facilities" version="1">
    <ind:path>/etc/rsyslog.d</ind:path>
    <ind:filename operation="pattern match">^.*$</ind:filename>
    <ind:pattern operation="pattern match">(?m)^[\s]*\*\.\*[\s]+(/var/log/messages|action\(\s*.*(?i:\btype\b)="omfile"\s*.*(?i:\bfile\b)="/var/log/messages"\s*\))\s*(?:#.*)?$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
  {{% endif %}}

</def-group>
