Previous: filters, Up: filters


1.14.1 Complete filter examples

Here is an example filter to search for all files which are either directories or links, or any kind of file owned by mark, in group cfengine.

     
     control:
     
      actionsequence = ( files )
     
     files:
     
      /tmp       filter=testfilteralias action=alert r=inf
      /cfengine  filter=testfilteralias action=fixall r=inf mode=644
     
     filters:
     
       { testfilteralias
     
       Owner:     "mark"
       Group:     "cfengine"
       Type:      "dir|link"
     
       Result:    "Type|(Owner.Group)"  # Both owner AND group required correct
       }
     

Find all ELF executables using data from the Unix file command. Caution, this takes a long time if used indescriminately.

     
     control:
     
      actionsequence = ( files )
     
     files:
     
      /tmp       filter=testfilteralias action=alert r=inf
      /cfengine  filter=testfilteralias action=fixall r=inf mode=644
     
     filters:
     
       { testfilteralias
     
       ExecRegex: "/bin/file (.*ELF.*)"
     
       Result: "ExecRegex"
       }

Here is an example which warns of any process coupled to a terminal started in November:

     control:
     
      actionsequence = ( processes )
     
     filters:
     
       { filteralias
       FromSTime: "date(2000,11,0,0,0,0)"
       ToSTime:   "date(2000,11,30,0,0,0)"
       TTY: ".*pt.*"
       Result: "TTY.STime"
       }
     
     processes:
     
      "." filter=filteralias action=warn