<def-group>
  <definition class="compliance" id="auditd_offload_logs" version="1">
    {{{ oval_metadata("Check if a script for audit offload exists in /etc/cron.weekly/", rule_title=rule_title) }}}
    <criteria operator="AND">
        <criterion comment="audit offload script" test_ref="test_etc_cron_weekly_audit_offload_exists" />
    </criteria>
  </definition>

  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="/etc/cron.weekly/audit-offload exists" id="test_etc_cron_weekly_audit_offload_exists" version="1">
      <ind:object object_ref="object_etc_cron_weekly_audit_offload_exists" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object comment="/etc/cron.weekly/audit-offload file exists" id="object_etc_cron_weekly_audit_offload_exists" version="1">
    <ind:filepath>/etc/cron.weekly/audit-offload</ind:filepath>
    <ind:pattern operation="pattern match">^.*$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
</def-group>
