Merge pull request #14731 from vojtapolasek/stab_fix_rsyslog_oval

Stabilization: Fix rsyslog rainerscript oval

Author: jan-cerny

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/oval/shared.xml

@@ -27,7 +27,7 @@
   {{% macro object_remote_method(method, test_ref) %}}
   <ind:textfilecontent54_object id="obj_{{{ test_ref }}}" version="1">
     <ind:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind:filepath>
-    <ind:pattern operation="pattern match">^[ \t]*(?:(?:\w+,)*{{{ method }}}(?:,\w+)*\.\*|\S+;{{{ method }}}\.\*|{{{ method }}}\.\*;\S+|\S+;{{{ method }}}\.\*;\S+)[ \t]+(?:(?!action\()\S+|action\([^)]*file\s*=\s*["'][^"']+["'][^)]*\))\s*$</ind:pattern>
+    <ind:pattern operation="pattern match">^[ \t]*(?:(?:\w+,)*{{{ method }}}(?:,\w+)*\.\*|\S+;{{{ method }}}\.\*|{{{ method }}}\.\*;\S+|\S+;{{{ method }}}\.\*;\S+)[ \t]+(?:(?!(?i)action(?-i)\()\S+|(?i)action(?-i)\([^)]*(?i)file(?-i)\s*=\s*["'][^"']+["'][^)]*\))\s*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
   {{% endmacro %}}

linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/tests/rainerscript_action.pass.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# platform = multi_platform_all
+
+rm -rf /etc/rsyslog.d/*
+true > /etc/rsyslog.conf
+
+# Use RainerScript action() syntax with capitalized File property
+echo '*.info;daemon.*;kern.*;auth.*;mail,authpriv,cron.none   action(name="local-messages" type="omfile" File="/var/log/messages")' >> /etc/rsyslog.conf
+echo 'authpriv.*   action(name="local-authpriv" type="omfile" File="/var/log/secure")' >> /etc/rsyslog.conf