diff --git a/global/overlay/etc/puppet/cosmos-rules.yaml b/global/overlay/etc/puppet/cosmos-rules.yaml
index a021caf..5e5799b 100644
--- a/global/overlay/etc/puppet/cosmos-rules.yaml
+++ b/global/overlay/etc/puppet/cosmos-rules.yaml
@@ -21,6 +21,9 @@
       - nrpe_check_users
       - nrpe_check_zombie_procs
 
+'^(?!.*rsyslog).*$':
+  soc::rsyslog::client:
+
 '^vul-dashboard-test.cert.sunet.se$':
   sunet::dockerhost2:
   sunet::certbot::acmed: