Skip to content
Switch branches/tags
Go to file

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time

License CII Best Practices Puppet Forge Puppet Forge Downloads Build Status

Table of Contents

This is a SIMP module

This module is a component of the System Integrity Management Platform, a compliance-management framework built on Puppet.

If you find any issues, they can be submitted to our JIRA.

This module is optimally designed for use within a larger SIMP ecosystem, but it can be used independently:

  • When included within the SIMP ecosystem, security compliance settings will be managed from the Puppet server.
  • In the future, all SIMP-managed security subsystems will be disabled by default and must be explicitly opted into by administrators. Please review simp/simp_options for details.

Module Description

This module sets up openscap and allows you to schedule and log openscap runs.


What simp openscap affects

simp/openscap will manage:

  • openscap-utils and scap-security-guide packages

simp/openscap::schedule will manage:

  • A cron job for openscap runs
  • A logging directory for openscap (Default: /var/log/openscap)

Setup Requirements

The module can support logrotate if simp/logrotate is used. Otherwise, no additional setup is required.

Beginning with openscap

You can install openscap by:

include 'openscap'


I want to install openscap with default logging

The following will run a cron job on Monday at 1:30 AM and log to /var/log/openscap:

class { 'openscap':
  enable_schedule => true,


include 'openscap::schedule'

I have a particular SCAP profile I want to use

class { 'openscap::schedule':
  scap_profile => 'xccdf_org.ssgproject.content_profile_stig-rhel7-server-upstream',

I want to log daily at a set time

class { 'openscap::schedule':
  minute  => 00,
  hour    => 22,
  weekday => '*',

I want to log on the first and fifteenth day of the month

class { 'openscap::schedule':
  monthday => '1,15',

I want to log to a different directory

class { 'openscap::schedule':
  logdir => '/opt/scaplogs',


Please see the


This module is designed to work in RHEL-compatible environments.


Please read our Contribution Guide.