Epoc time conversion, relevance, and boolean statements

1

Hello,

First time poster! :slight_smile: I am also new to BigFix so forgive me if my logic/wording is not the most correct.

I am having an issue with converting epoc time inside an boolean statement.

This is my original relevance:

(it * second + “01 Jan 1970 00:00:00” as local time) of (following text of first ": " of (line 10 of file “/var/nessus.txt”) as integer)

This works for 99% of my machines when running an analysis, however if the application is not installed then it will return an error inside the results/bigfix web reports: “Singular expression refers to nonexistent object.”

I believe the issue is if the folder or application cannot be found it has no value to return, so I need to make this a boolean statement. However, it seems I cannot have an integer and a string as apart of the relevancy statement. This is what I have so far and it will not seem to work no matter what I change or change it to:

if exists file “/var/nessus.txt” then (it * second + “01 Jan 1970 00:00:00” as local time) of (following text of first ": " of line 10 of file “/var/nessus.txt” as integer) else “Connection Issues”

(Since it is linux I have a text file being created with information I need for the Analysis, so line 10 is where the las connection time is located in the txt file.)

Any help will be greatly appreciated!

Thank you so much!

-Bozzy

2

First, welcome to BigFix!

There are several different ways to handle a query like this. The first thing to know is that we can refer to most inspectors and properties as either ‘singular’ or ‘plural’. When using a ‘singular’ form, like 'line 10 of file "/var/nessus.txt"', we expect exactly one answer. More than one result will give a “Singular expression refers to non-unique object”. Zero results will give a “Singular expression refers to nonexistent object” message.

One way to avoid this is to use plural forms like 'lines 10 of files "/var/nessus.txt"'. In the case that either the file is missing, or has no line 10, you’ll simply end up with an empty result instead of an error message. In the Console view of this property, you’d have 99% of your computers showing a timestamp and the remaining showing an empty cell.

Another option, as you’ve started, is to use an if/then/else construct to return a message if the file is missing or timestamp cannot be retrieved. However in an if/then/else, both the ‘then’ and ‘else’ clauses must return the same datatype - which means if you want to return a string message on the ‘else’, then you must also convert your timestamp value to a string on the ‘then’ clause, like

if exists file "/var/nessus.txt" then (it * second + "01 Jan 1970 00:00:00" as local time) of (following text of first ": " of line 10 of file "/var/nessus.txt" as integer) as string else "Connection Issues"

Yet another option, that I tend to like, is to use the pipe operator “|”. It works by substituting a message or value when an error occurs. If the left side of the pipe throws an error, the right side of the pipe is substituted. Like the if/then/else, both sides of the pipe must return the same datatype (with the exception that an error type could also be returned, if you like)

(it * second + "01 Jan 1970 00:00:00" as local time ) of (following text of first ": " of line 10 of file "/var/nessus.txt" as integer) as string | "Connection Issue"

or

(it * second + "01 Jan 1970 00:00:00" as local time ) of (following text of first ": " of line 10 of file "/var/nessus.txt" as integer) | error "Connection Issue"

edit: moved the string cast outside the time calculation

2 Likes
3

This worked! Thank you so much!

Also thank you so much for explaining the various methods I can go about handling this. This was very beneficial and will help me in so many way moving forward.

1 Like