<def-group>
  <definition class="compliance" id="rsyslog_remote_tls_cacert" version="1">
    {{{ oval_metadata("Check that the CA certificate path is set") }}}
    <criteria comment="Check that CA certificate is configured for rsyslog remote logging" operator="AND">
      <criterion comment="Check that the CA certificate path is set" test_ref="test_rsyslog_remote_tls_cacert" />
    </criteria>
  </definition>

  <ind:textfilecontent54_test id="test_rsyslog_remote_tls_cacert"
    comment="tests the DefaultNetstreamDriverCAFile configuration"
    check_existence="at_least_one_exists" check="all" version="1">
    <ind:object object_ref="obj_rsyslog_remote_tls_cacert" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="obj_rsyslog_remote_tls_cacert" version="1">
    <ind:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind:filepath>
    <ind:pattern operation="pattern match">^\s*global\(DefaultNetstreamDriverCAFile="(.+?)"\)\s*\n</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">0</ind:instance>
  </ind:textfilecontent54_object>
</def-group>
