Bigfix relevance for filtering a long list of output

Content Authoring BigFix.me
1

I am currently working with a Linux file and using BigFix relevance to filter lines containing a specific string. My current relevance successfully filters the file for lines containing "SUBDEBUG", but it returns thousands of lines, which is difficult to manage.

Here is the relevance I am currently using:

(lines (integers in (number of lines of file “/var/log/dnf.rpm.log”, 1)) of file “/var/log/dnf.rpm.log”) whose (it contains “SUBDEBUG”)

This relevance filters all lines in the file containing "SUBDEBUG", but the output is massive.

I was able to fetch the last N lines of the file using the following relevance:

(lines (integers in (number of lines of files “/var/log/dnf.rpm.log” - 500, number of lines of files “/var/log/dnf.rpm.log”)) of files “/var/log/dnf.rpm.log”) whose (it contains “SUBDEBUG”)

However, this only filters lines from the last 500 lines of the file, not the last N lines of the filtered output.

What I want is a relevance that:

  1. Filters the file for lines containing "SUBDEBUG".
  2. Returns only the last N lines of that filtered output, regardless of their position in the file.

I haven’t been able to find a way to achieve this yet. As we need this for a customer. Any suggestions or solution would be helpful.

2

This is going to be very expensive to do in Relevance, BigFix isn’t really designed as a log parsing tool.

This may be better done with an Action that just does a grep & tail on the log file.