An XCCDF Rule
/etc/rsyslog.conf
/etc/rsyslog.d/*.conf
auth.*
authpriv.*
daemon.*
auth.*;authpriv.* /var/log/secure daemon.* /var/log/messages