<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("
      The frequency of automatic log files rotation performed by the logrotate utility should be configured to run daily
      ", rule_title=rule_title) }}}
    <criteria comment="/etc/logrotate.conf contains daily setting and /etc/cron.daily/logrotate file exists" operator="AND">
      <extend_definition comment="package logrotate installed" definition_ref="package_logrotate_installed" />
      <criterion comment="Check if daily is set in /etc/logrotate.conf"
      test_ref="test_logrotate_conf_daily_setting" />
      <criterion comment="check that there is no weekly/monthly/yearly keyword in logrotate.conf"
      test_ref="test_logrotate_conf_no_other_keyword" />
      <criteria comment="Check if either logrotate timer or cron job is enabled" operator="OR">
        <criterion comment="Check if /etc/cron.daily/logrotate file exists (and calls logrotate)" test_ref="test_cron_daily_logrotate_existence" />
{{% if product in ["ol9", "rhcos4", "rhel9", "rhel10", "sle12", "sle15", "slmicro5"] %}}
        <criterion comment="Check if logrotate timer is enabled" test_ref="test_logrotate_enabled_systemd_target" />
{{% endif %}}
      </criteria>
    </criteria>
  </definition>

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="Tests the presence of daily setting in /etc/logrotate.conf file"
  id="test_logrotate_conf_daily_setting" version="1">
    <ind:object object_ref="object_logrotate_conf_daily_setting" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_logrotate_conf_daily_setting" version="2">
    <ind:filepath>/etc/logrotate.conf</ind:filepath>
    <ind:pattern operation="pattern match">^\s*daily[\s#]*$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

<ind:textfilecontent54_test check="all" check_existence="none_exist"
  comment="Test if there is no weekly/monthly/yearly keyword"
  id="test_logrotate_conf_no_other_keyword" version="1">
    <ind:object object_ref="object_logrotate_conf_no_other_keyword" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_logrotate_conf_no_other_keyword" version="2">
    <ind:filepath>/etc/logrotate.conf</ind:filepath>
    <ind:pattern operation="pattern match">^\s*(weekly|monthly|yearly)[\s#]*$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="Tests the existence of /etc/cron.daily/logrotate file (and verify it actually calls logrotate utility)"
  id="test_cron_daily_logrotate_existence" version="1">
    <ind:object object_ref="object_cron_daily_logrotate_existence" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_cron_daily_logrotate_existence" version="1">
    <ind:filepath>/etc/cron.daily/logrotate</ind:filepath>
    <ind:pattern operation="pattern match">^[\s]*/usr/sbin/logrotate[\s\S]*/etc/logrotate.conf$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  {{% if product in ["ol9", "rhcos4", "rhel9", "rhel10", "sle12", "sle15", "slmicro5"] %}}
  <unix:file_test check="all" check_existence="all_exist"
   comment="look for logrotate.timer in multi-user.target.wants and timers.target.wants"
   id="test_logrotate_enabled_systemd_target" version="1">
    <unix:object object_ref="object_logrotate_enabled_systemd_target" />
  </unix:file_test>

  <unix:file_object comment="look for logrotate.timer in /etc/systemd/system/multi-user.target.wants and /etc/systemd/system/timers.target.wants"
   id="object_logrotate_enabled_systemd_target" version="1">
    <unix:filepath operation="pattern match">^/etc/systemd/system/(multi-user|timers)\.target\.wants/logrotate\.timer$</unix:filepath>
    <filter action="include">unit_logrotate_state_symlink</filter>
  </unix:file_object>

  <unix:file_state id="unit_logrotate_state_symlink" version="1">
    <unix:type operation="equals">symbolic link</unix:type>
  </unix:file_state>
{{% endif %}}

</def-group>
