The 'rsyslog' daemon should not accept remote messages unless the system acts as a log server. If the system needs to act as a central log server, add the following lines to '/etc/rsyslog.conf' to enable reception of messages over TCP: $ModLoad imtcp $InputTCPServerRun 514 [no/yes] If the system needs to act as a log server, this ensures that it can receive messages over a reliable TCP connection. oval:org.secpod.oval:def:30318 oval:org.secpod.oval:def:31041 SCAP Repo OVAL Definition 2015-11-13