
<def-group>
    <definition class="compliance" id="{{{ rule_id }}}" version="1">
        {{{ oval_metadata("Rsyslogd must encrypt the off-loading of logs off of the system.") }}}
        <criteria operator="AND">
            <criteria operator="OR">
                <criterion comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf"
                            test_ref="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog" />
                <criterion comment="Check if StreamDriverMode is set to 1 in /etc/rsyslog.conf using RainerScript"
                            test_ref="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_rainer" />
                <criterion comment="Check if $ActionSendStreamDriverMode 1 is set in files in /etc/rsyslog.d"
                            test_ref="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir" />
                <criterion comment="Check if StreamDriverMode is set to 1 in files in /etc/rsyslog.d using RainerScript"
                            test_ref="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir_rainer" />
            </criteria>
        </criteria>
    </definition>

{{% set legacy_regex = "^\\$ActionSendStreamDriverMode 1$" %}}
{{% set rainer_script_regex = "^\\s*action\\(.*(?i)\\btype\\b(?-i)=\"omfwd\".*(?i)\\bStreamDriverMode\\b(?-i)=\"1\".*\\)\\s*$" %}}

    <ind:textfilecontent54_test check="all" check_existence="all_exist"
                                comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf"
                                id="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog" version="1">

        <ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog" />
    </ind:textfilecontent54_test>

    <ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog"
                                    comment="Check if  $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf"
                                    version="1">
        <ind:filepath>/etc/rsyslog.conf</ind:filepath>
        <ind:pattern operation="pattern match">{{{ legacy_regex }}}</ind:pattern>
        <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>

    <ind:textfilecontent54_test check="all" check_existence="all_exist"
                                comment="Check if StreamDriverMode is set to 1 in /etc/rsyslog.conf using RainerScript"
                                id="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_rainer" version="1">

        <ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_rainer" />
    </ind:textfilecontent54_test>

    <ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_rainer"
                                    comment="Check if StreamDriverMode is set to 1 in /etc/rsyslog.conf using RainerScript"
                                    version="1">
        <ind:filepath>/etc/rsyslog.conf</ind:filepath>
        <ind:pattern operation="pattern match">{{{ rainer_script_regex }}}</ind:pattern>
        <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>

    <ind:textfilecontent54_test check="all" check_existence="all_exist"
                                comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf"
                                id="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir" version="1">
        <ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir" />
    </ind:textfilecontent54_test>

    <ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir"
                                    comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.d"
                                    version="1">
        <ind:path>/etc/rsyslog.d</ind:path>
        <ind:filename operation="pattern match">^.*conf$</ind:filename>
        <ind:pattern operation="pattern match">{{{ legacy_regex }}}</ind:pattern>
        <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>

    <ind:textfilecontent54_test check="all" check_existence="all_exist"
                                comment="Check if StreamDriverMode is set to 1 in files in /etc/rsyslog.d using RainerScript"
                                id="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir_rainer" version="1">
        <ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir_rainer" />
    </ind:textfilecontent54_test>

    <ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir_rainer"
                                    comment="Check if StreamDriverMode is set to 1 in files in /etc/rsyslog.d using RainerScript"
                                    version="1">
        <ind:path>/etc/rsyslog.d</ind:path>
        <ind:filename operation="pattern match">^.*conf$</ind:filename>
        <ind:pattern operation="pattern match">{{{ rainer_script_regex }}}</ind:pattern>
        <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
</def-group>
