diff --git a/tasks/section_6/cis_6.2.3.x.yml b/tasks/section_6/cis_6.2.3.x.yml
index 9d26acf..ca1b9de 100644
--- a/tasks/section_6/cis_6.2.3.x.yml
+++ b/tasks/section_6/cis_6.2.3.x.yml
@@ -130,8 +130,8 @@
           # misc. logging additions to meet CIS standards
           *.=warning;*.=err                                        -/var/log/warn
           *.crit                                                   /var/log/warn
-          *.*;mail.none;news.none                                  /var/log/messages
-        insertafter: '#### RULES ####'
+          *.*;news.none                                            /var/log/messages
+        insertbefore: '# ### sample forwarding rule ###'
       notify: Restart rsyslog
 
     - name: "6.2.3.5 | PATCH | Ensure logging is configured | Local log settings"