What were they thinking (or what am I missing)?

So, looking though some old analyses I’d written long ago, I came across a Relevance statement that I’d copy-and-pasted from another source (possibly a BigFix provided Fixlet or Task) and for the life of me I can’t figure out why it was written the way it was:

(version of client >= "6.0.0.0") AND (exists true whose (if true then (exists (name of operating system & " " & csd version of operating system ) whose (it as string as lowercase contains "Win" as lowercase)) else false))

Am I wrong to think that this is needlessly overly complicated? The “version of client” part is fine, of course, but why not just have “windows of operating system” (for clients > 8.0) or even simply “name of operating system as lowercase contains “win””. As it is it’s just kinda ridiculous. There are many other Relevance statements I’ve seen in BigFix authored Fixlets that have a “if (condition) then true else false” pattern instead of just using “condition”. Is there a perfectly good reason for this that I’m unaware of, or is the code unnecessarily redundant?

1 Like

You are correct that most of the IBM provided relevance is overly complicated, but not always needlessly. (though often needlessly)

In general I would not recommend following most of IBM’s relevance as a “Best Practice” for this reason.

The reason this crazy relevance isn’t always needless is to account for VERY old clients that do not have an ability to handle this relevance because they lack the inspectors. The other reason for this is that some inspectors are missing from one OS but exist in another. In a case where the Fixlet/Task should apply to multiple OSes, but you need to write relevance that only works in 1 of the families of OSes, you need to prevent the missing inspectors from throwing an error on all of the other OSes, which will have there own separate relevance statements that would filter them specifically.

This is really a complicated form of relevance to suppress errors.


No matter what you put in the () after then, it will not throw an error: (unless there is a syntax error)

exists TRUE whose(if TRUE then (THIS_SHOULD_THROW_AN_ERROR_BUT_IT_WILL_NOT) else FALSE)

I actually used this technique in a project to do remote relevance evaluation.

parameter "relevance_result" = "{ concatenations "~" of (base64 encode it) of unique values of ( if ( exists true whose (if true then (exists (it as string) of REPLACE_WITH_DESIRED_REMOTE_RELEVANCE_QUERY) else false) ) then (it as string) of (REPLACE_WITH_DESIRED_REMOTE_RELEVANCE_QUERY) else "Error!" ) }"

This parameter will always be set to a string of some kind. It will either be set to the string results of whatever relevance is replaced in the two spots, or with “Error!”.

You can find the full task here: https://github.com/jgstew/remote-relevance/blob/master/Remote_Relevance_Action_TEMPLATE.bes.xml

2 Likes

Cool … good to know. Thanks!

Now … about that (“Win” as lowercase) part … :confused: