Note: If the system administrator can demonstrate that another tool (e.g., SPLUNK) is being used to manage log offload and aggregation in lieu of rsyslog, this is not applicable. Verify OL 9 is not configured to receive remote logs using rsyslog with the following commands: $ ss -tulnp | grep rsyslog If no output is returned, rsyslog is not listening for remote messages and is compliant. If output appears, check for configured ports (514 is the default for syslog). Check for remote logging configuration in rsyslog by examining the rsyslog configuration files: $ sudo grep -E 'InputTCPServerRun|UDPServerRun|RELPServerRun|imtcp|imudp|imrelp' /etc/rsyslog.conf /etc/rsyslog.d/* If this command returns uncommented lines enabling network listeners, the system is accepting remote logs. If this system is not documented and authorized as a log aggregation server, this is a finding.