From 942870f78d704a68ce9ca444e7578df5f59ed497 Mon Sep 17 00:00:00 2001
From: chrispipo <98947717+chrispipo@users.noreply.github.com>
Date: Wed, 18 Jun 2025 08:37:22 +0000
Subject: [PATCH] update: change insertafter by insertbefore for MISC. LOG
 SETTINGS

---
 tasks/section_6/cis_6.2.3.x.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tasks/section_6/cis_6.2.3.x.yml b/tasks/section_6/cis_6.2.3.x.yml
index 9d26acf..ca1b9de 100644
--- a/tasks/section_6/cis_6.2.3.x.yml
+++ b/tasks/section_6/cis_6.2.3.x.yml
@@ -130,8 +130,8 @@
           # misc. logging additions to meet CIS standards
           *.=warning;*.=err                                        -/var/log/warn
           *.crit                                                   /var/log/warn
-          *.*;mail.none;news.none                                  /var/log/messages
-        insertafter: '#### RULES ####'
+          *.*;news.none                                            /var/log/messages
+        insertbefore: '# ### sample forwarding rule ###'
       notify: Restart rsyslog
 
     - name: "6.2.3.5 | PATCH | Ensure logging is configured | Local log settings"