I am having an issue where from time to time relevance fails within an action script. In the cases where i had an issue i confirmed that the relevance works in both the debugger and also an analysis. This specific task is attempting to validate that the Symantec AV defs are current (at least within a few days old) and then zips them up to be copied into a staging area. My task keeps failing on (parameter “DefDaysOld” = “{current date - parameter “CurDefsDate” of action}”). I have also tried getting the result without using any parameters.
See below for the whole script.
// Set Vars
parameter “CurDefs” = “{key “CurDefs” of section “DefDates” of file “C:\Program Files\Common Files\Symantec Shared\VirusDefs\definfo.dat”}”
parameter “CurDefsDate” = “{date (( last 2 of it & " " & first 3 of (month (last 2 of first 6 of it as integer) as string) & " " & first 4 of it) of preceding text of last “.” of parameter “CurDefs” of action)}”
parameter “DefDaysOld” = “{current date - parameter “CurDefsDate” of action}”
// Check to make sure server has current defs
continue if {parameter “DefDayOld” of action < 6*day}
{current date - parameter “CurDefsDate” of action}
Is failing because ‘current date’ is a date and ‘parameter “CurDefsDate” of action’ is a string and you can’t subtract a string from a date. You probably need to cast the parameter to be a date first.
Also, watch this line, the ‘of action’ is missing from the relevance substitution and it will probably fail too.
I had to make two changes to get it working. First i had to cast the parameter as a date as you suggested. Second i had to cast as time interval in my continue if statement.
Final working script
// Set Vars
parameter “CurDefs” = “{key “CurDefs” of section “DefDates” of file “C:\Program Files\Common Files\Symantec Shared\VirusDefs\definfo.dat”}”
parameter “CurDefsDate” = “{date (( last 2 of it & " " & first 3 of (month (last 2 of first 6 of it as integer) as string) & " " & first 4 of it) of preceding text of last “.” of parameter “CurDefs” of action)}”
parameter “DefDaysOld” = “{current date - (parameter “CurDefsDate” of action) as date}”
// Check to make sure server has current defs
continue if {parameter “DefDaysOld” of action as time interval < 6*day}