Greetings, we are checking for a socket connection on a specific port. Multiple OS’s.
exists sockets whose(remote port of it = DDDD AND established of tcp state of it) of networks
DDDD is the specific port number I am looking for. Weirdly, on certain linux versions, I get the following error:
“The expression could not be evaluated for an unknown reason.”
If you have any idea on what I am doing wrong, please let me know.
Thanks!
An obvious question, where are you evaluating this? In the agent as a property or in qna?
On the agent via an Analysis.
The inspectors you are using are implemented across all of our supported Linux agents. Your relevance looks solid.
Can you share any details on the specific linux versions where you get the error?
Can you also try this test of each inspector you are using, it might give us clues on where the issue is?
q: if exists property "network" whose (exists networks) then (if (exists property "socket" whose (exists sockets of networks)) then (if exists property "remote port" whose (exists remote ports of sockets of networks) then (if (exists property "tcp state" whose (exists tcp states of sockets of networks)) then (if (exists property "established" whose (exists establisheds of tcp states of sockets of networks)) then ("Inspectors present and responsive") else (error "issue with Established inspector")) else (error "issue with TCP States inspector")) else (error "issue with Remote Port inspector")) else (error "issue with Socket inspector")) else (error "issue with Network inspector")
A: Inspectors present and responsive
q: number of networks|error"issue Network"; number of sockets of networks|error"issue Sockets"; number of remote ports of sockets of networks|error"issue Report Ports"; number of tcp states of sockets of networks|error"issue TCP States"; number of establisheds of tcp states of sockets of networks|error"issue Establisheds"
A: 1
A: 127
A: 32
A: 73
A: 73
We can also use that layered error trapping in the final like this
q: if exists property "network" whose (exists networks) then (if (exists property "socket" whose (exists sockets of networks)) then (if exists property "remote port" whose (exists remote ports of sockets of networks) then (if (exists property "tcp state" whose (exists tcp states of sockets of networks)) then (if (exists property "established" whose (exists establisheds of tcp states of sockets of networks)) then (exists sockets whose(remote port of it = 1234 AND established of tcp state of it) of networks) else (error "issue with Established inspector")) else (error "issue with TCP States inspector")) else (error "issue with Remote Port inspector")) else (error "issue with Socket inspector")) else (error "issue with Network inspector")
A: FalseThanks!
I will run those queries today against the native agents.
Working -> Linux Red Hat Enterprise Server 7.9 (3.10.0-1160.31.1.el7.x86_64)
Also working on Amazon Linux and a ton of various windows flavors
Not Working -> Linux CentOS 7.9.2009 (3.10.0-1160.31.1.el7.x86_64)
The first one gave me issue with Socket inspector and the second was 1 & issue with Socket inspector.
@Viking That was very helpful. Now we know that the issue is with the Sockets inspector on CentOS specifically. I think it’s time to open a ticket with support.bigfix.com to report the issue.