Putting together 2 relevance statements

(imported topic written by jrbast)

I want to do both of these in a relevance statements together to return a T/F answer,but using “or” between them, but get an error of: “Single expression is required”

Q: (sha1 of it != (sha1 of file “/opt/software/Quest/oam/fit/cacert.pem”)) of (files “cacert.pem” of folders “simpleCA” of folders “openssl” of folders “tools” of folders “oblix” of folders “access” of folders of folders “oracle” of folders “/opt”)

A: False

T: 4612

Q: (sha1 of it != (sha1 of file “/opt/software/Quest/oam/fit/aaa_cert.pem”)) of (files “aaa_cert.pem” of folders “simple” of folders “config” of folders “oblix” of folders “access” of folders of folders “oracle” of folders “/opt”)

A: True

T: 44028

Q: ((sha1 of it != (sha1 of file “/opt/software/Quest/oam/fit/cacert.pem”)) of (files “cacert.pem” of folders “simpleCA” of folders “openssl” of folders “tools” of folders “oblix” of folders “access” of folders of folders “oracle” of folders “/opt”)) or ((sha1 of it != (sha1 of file “/opt/software/Quest/oam/fit/aaa_cert.pem”)) of (files “aaa_cert.pem” of folders “simple” of folders “config” of folders “oblix” of folders “access” of folders of folders “oracle” of folders “/opt”))

E: A singular expression is required.

A different way works with “descendents of” , but performance is not acceptable or recommended to be used in relevance statements

(exists (descendants of folder “/opt/oracle”) whose ( pathname of it contains “/access/oblix/tools/openssl/simpleCA/cacert.pem” and name of it = “cacert.pem” and pathname of it does not contain “oam” and sha1 of it != (sha1 of file “/opt/software/Quest/oam/fit/cacert.pem” ))) or (exists (descendants of folder “/opt/oracle”) whose ( pathname of it contains “/access/oblix/config/simple/aaa_cert.pem” and name of it = “aaa_cert.pem” and pathname of it does not contain “oam” and sha1 of it != (sha1 of file “/opt/software/Quest/oam/fit/aaa_cert.pem” )))

(imported comment written by liuhoting)

Have you tried the “disjunction” relevance pattern?

http://support.bigfix.com/cgi-bin/inspectorsearch/single_inspector.cgi?cpx=c&keyphrase=disjunction+of+%26lt%3Bboolean%26gt%3B&type=boolean&win=&lin=&hpux=&mac=&aix=&sol=&wm=&ubu=&client=1&core=1

So it would be:

disjunction of (relevance statement 1; relevance statement 2)

(imported comment written by jrbast)

Got it to work using the following, but:

exist (files “cacert.pem” of folders “simpleCA” of folders “openssl” of folders “tools” of folders “oblix” of folders “access” of folders of folders “oracle” of folders “/opt”) whose (sha1 of it != (sha1 of file “/opt/software/Quest/oam/fit/cacert.pem”)) or exist (files “aaa_cert.pem” of folders “simple” of folders “config” of folders “oblix” of folders “access” of folders of folders “oracle” of folders “/opt”) whose (sha1 of it !=(sha1 of file “/opt/software/Quest/oam/fit/aaa_cert.pem”))

How would I make it work for Windows system where /opt in linux would be D:\ on windows?

Listing the files on a windows system gives strange results for pathname (see below)

(files “cacert.pem” of folders “simpleCA” of folders “openssl” of folders “tools” of folders “oblix” of folders “access” of folders of folders “oracle” of folders of folder “D:”)

“cacert.pem” “” “” “” “”

Any help here would be great as I don’t use bigfix for Windows much as I’m a unix guy.

Thanks

(imported comment written by jgstew)

Can you give the paths of the files you are interested in directly, like “D:\folder\folder” so that I can make sense of what you’re trying to do.

It looks like you are trying to compare 2 different .pem files to see if they are the same, but your relevance seems unnecessarily complicated.

(exists files “/opt/oracle/access/oblix/tools/openssl/simpleCA/cacert.pem” whose (sha1 of it !=
(sha1 of file “/opt/software/Quest/oam/fit/cacert.pem”))) OR
(exists files “/opt/oracle/access/oblix/config/simple/aaa_cert.pem” whose (sha1 of it !=
(sha1 of file “
/opt/software/Quest/oam/fit/aaa_cert.pem
”)))

pathname of files “cacert.pem” of folders “access\oblix\tools\openssl\simpleCA” of folders whose(exists folders “access\oblix\tools\openssl\simpleCA” of it) of folders “oracle” of folders whose(exists folders “oracle” of it) of folders “D:”

(imported comment written by jrbast)

ok,

I’m comparing a path on a client system to a master file of the same name using sha1 values.

There are 2 files that are being compareed to there master files. aaa_cert.pem and cacert.pem

This started out as a question on getting the proper T/F answer when the individual result of the 2 are different. SO I’m checking if they are != to get a true answer. I added exists to each with an or between them and seem to getting what I need.

It has now evolved to be a bit more complicated:

Q: exists (files “cacert.pem” of folders “simpleCA” of folders “openssl” of folders “tools” of folders “oblix” of folders “access” of folders of folders “oracle” of folders “/opt”) whose (sha1 of it != (sha1 of file “/opt/software/Quest/oam/prod/cacert.pem”) and ( pathname of it does not contain “oam”)) or exists (files “aaa_cert.pem” of folders “simple” of folders “config” of folders “oblix” of folders “access” of folders of folders “oracle” of folders “/opt”) whose (sha1 of it !=(sha1 of file “/opt/software/Quest/oam/prod/aaa_cert.pem”) and ( pathname of it does not contain “oam”))

A: True

So part of it that is TRUE: (second relevance after the “or”

Q: (files “aaa_cert.pem” of folders “simple” of folders “config” of folders “oblix” of folders “access” of folders of folders “oracle” of folders “/opt”) whose (sha1 of it !=(sha1 of file “/opt/software/Quest/oam/prod/aaa_cert.pem”) and ( pathname of it does not contain “oam”))

A: /opt/oracle/webgate2/access/oblix/config/simple/aaa_cert.pem

The first half returns nothing or a false answer, overall a TRUE

(imported comment written by jgstew)

Did you try the options I provided?

(imported comment written by jgstew)

Also, I would highly recommend trying to debug relevance in an analysis for this specific case. Have separate properties for the sha1’s of each of the separate files.

Then also break up the more complicated relevance into separate and combined versions.

Like one could be:

(exists files “/opt/oracle/access/oblix/tools/openssl/simpleCA/cacert.pem” whose (sha1 of it != (sha1 of file “/opt/software/Quest/oam/fit/cacert.pem”)))

Another:

(exists files “/opt/oracle/access/oblix/config/simple/aaa_cert.pem” whose (sha1 of it != (sha1 of file “/opt/software/Quest/oam/fit/aaa_cert.pem”)))

another:

sha1 of file “/opt/software/Quest/oam/fit/aaa_cert.pem”

etc…

(imported comment written by jrbast)

yas, I have and this all now works as you recommended