Multiple action parameter query input in Relevance

Content Authoring
1

Hi

We are running a relevance which is

continue if {not exists lines whose (it contains (parameter “IP”) and it as uppercase contains (parameter “HOSTNAME” as uppercase)) of file “c:\windows\system32\drivers\etc\hosts”}

Here we are also using action parameter query to give our input for IP and HOSTNAME.

We want to give multiple inputs for IP 10.192.10.1, 10.10.192.34 192.168.10.1 and HOSTNAME server1 server2 server 3 in above relevance using this action parameter query, how can we achieve this, kindly advise.

2

Your current relevance takes one IP and one hostname and checks each line to see if the line has both the IP and hostname. When you add multiples, is the hostname<>IP relationship still important?

in other words should 10.192.10.1 server1 match? how about 10.192.10.1 server2, does that count as a match?

Dealing with the multiples in the action parameter query can be handled by asking for a comma separated list, and building the comparison based on substrings separated by ","

3

Thanks, you are right it should be match, can you pls provide me the complete working relevance?

4

@brolly33 pls help I need your help urgently to deliver this at client end…

5

You can try something below:

Parameter "ips"="10.192.10.1,10.10.192.34,192.168.10.1"
Parametet "hostname"="server1,server2,server3"

not exists ( (lines of file "c:\windows\system32\drivers\etc\hosts", item 0 of it, item 1 of it) whose ( (item 0 of it contains item 1 of it) and (item 0 of it as uppercase contains item 2 of it as uppercase) ) ) of ( (item 0 of it, item 1 of it) of ( substrings separated by "," of (parameter "ips" as trimmed string), substrings separated by "," of (parameter "hostname"  as trimmed string) ) )
1 Like
6

For testing/validation, you can try it using fixlet debugger:

//When I dont have your entries in my host file
Q: not exists ( (lines of file "c:\windows\system32\drivers\etc\hosts", item 0 of it, item 1 of it) whose ( (item 0 of it contains item 1 of it) and (item 0 of it as uppercase contains item 2 of it as uppercase) ) ) of ( (item 0 of it, item 1 of it) of ( substrings separated by "," of ("10.192.10.1,10.10.192.34,192.168.10.1" as trimmed string), substrings separated by "," of ("server1,server2,server3"  as trimmed string) ) )
A: True
T: 4.370 ms

//And when I do have those:
Q: not exists ( (lines of file "c:\windows\system32\drivers\etc\hosts", item 0 of it, item 1 of it) whose ( (item 0 of it contains item 1 of it) and (item 0 of it as uppercase contains item 2 of it as uppercase) ) ) of ( (item 0 of it, item 1 of it) of ( substrings separated by "," of ("10.192.10.1,10.10.192.34,192.168.10.1" as trimmed string), substrings separated by "," of ("server1,server2,server3"  as trimmed string) ) )
A: False
T: 3.847 ms
7

@vk.khurava thanks but here you are giving parameter value manually, we want to use action parameter query method where while taking action we can give input.kindly advise

8

No, the manual input I provided is for your ease, you can review my first response and make use of it as necessary.

well, while I’ve enjoyed our deep dive into BigFix relevance and session queries, I must say: But I strongly recommend hiring a BigFix Admin for your org. :smile:

9

@vk.khurava thanks I did not saw your first response… By the way bigfix admin is only person who is asking me this question…:smile:

1 Like
10

This is great technique. I love how you pulled the tuple items through, but I think this method does not keep the initial list joined, which what one of my refining questions. you are checking 9 combinations, not 3 combinations.

You can see this by looking at the base of your tuple

q: ((item 0 of it, item 1 of it) of ( substrings separated by "," of ("10.192.10.1,10.10.192.34,192.168.10.1" as trimmed string), substrings separated by "," of ("server1,server2,server3"  as trimmed string) ) )
A: 10.192.10.1, server1
A: 10.192.10.1, server2
A: 10.192.10.1, server3
A: 10.10.192.34, server1
A: 10.10.192.34, server2
A: 10.10.192.34, server3
A: 192.168.10.1, server1
A: 192.168.10.1, server2
A: 192.168.10.1, server3

I will take a few minutes at the start of my work day to try to solve this portion.

Update: Try this as your base, to join them properly. (Kudos to @JasonWalker for the inspiration to solve with Index)

q: (item 1 of item 0 of it, item 1 of item 1 of it) of ((index of it, it) of tuple items of item 0 of it, (index of it, it) of tuple items of item 1 of it)whose (item 0 of item 0 of it = item 0 of item 1 of it) of ("10.192.10.1, 10.10.192.34, 192.168.10.1", "server1, server2, server3")
A: 10.192.10.1, server1
A: 10.10.192.34, server2
A: 192.168.10.1, server3
2 Likes
11

@brolly33 thanks for the help. I am getting the correct output from the hostfile. But how I will add

continue if (exists those IP’s and servers available in the hostfile)?

12

@gsing1987 you would take the relevance supplied by @vk.khurava above with the “joined” relevance I provided.

Your continue if would look something like this:
( edited to contract the joining relevance - Thanks again @JasonWalker )

not exists ((lines of file "c:\windows\system32\drivers\etc\hosts", item 0 of it, item 1 of it) whose ((item 0 of it contains item 1 of it) and (item 0 of it as uppercase contains item 2 of it as uppercase))) of (tuple items of item 0 of it, tuple items of item 1 of it) whose (index of item 0 of it = index of item 1 of it) of (concatenation ", " of substrings separated by "," of (parameter "ips" as trimmed string) , concatenation ", " ofsubstrings separated by "," of (parameter "hostname" as trimmed string))