diff --git a/tasks/section_4/cis_4.2.1.x.yml b/tasks/section_4/cis_4.2.1.x.yml
index d7385de..6196c80 100644
--- a/tasks/section_4/cis_4.2.1.x.yml
+++ b/tasks/section_4/cis_4.2.1.x.yml
@@ -142,7 +142,7 @@
             marker: "#{mark} Auth SETTINGS (ANSIBLE MANAGED)"
             block: |
               # Private settings to meet CIS standards
-              auth,authpriv.*                                          -/var/log/secure
+              auth,authpriv.*                                           /var/log/secure
             insertafter: '#### RULES ####'
         notify: restart rsyslog