Hi Simon,
Thank you for helping me with this!
How does the default model score results? With my output of 192 passes and 2 unknowns
there is a 3.21% different, a deficit that 2 unknowns cannot make-up. I tried changing the
model to flat and this definitely helped things by bringing my pass percentage up to
98.97. In this case the 2 unknowns are clearly why I'm not at 100%. When using the
default model are passes, fails, and unknowns weighted differently? I'm going to
include the scan I've just run which has both the flat and default model for your
refference. As always thank you for taking the time to explain.
Sincerely,
Luke K
________________________________________
From: scap-security-guide-bounces(a)lists.fedorahosted.org
[scap-security-guide-bounces(a)lists.fedorahosted.org] on behalf of Simon Lukasik
[isimluk(a)fedoraproject.org]
Sent: Wednesday, July 16, 2014 2:02 AM
To: SCAP Security Guide; open-scap-list(a)redhat.com
Subject: EXTERNAL: Re: bug in html report
On 07/15/2014 06:24 PM, Kordell, Luke T wrote:
Hello,
I think there may be a bug in the way the pass/fail percentage is computed in the
html results from an open-scap scan. Currently I am showing 192 passes, 0 fails and 0
errors, but am at 96.79%. Is this actually a bug or am I missing something else? I am
going to attach my scan-results to this email, please let me know if you require any
further information.
Regards,
Luke Kordell
Hello Luke,
Thanks for checking with us.
I agree with you that the behavior may not be intuitive. Although, it is
in line with XCCDF standard.
You have two rules which yielded 'unknown' result.
There multiple ways how to score TestResult. What you see is scoring in
accordance with urn:xccdf:scoring:default model. This model requires
that 'unknown' results are counted as not compliant.
In order to use another scoring model (i.e. flat model), please include
<model system="urn:xccdf:scoring:flat"/>
in your Benchmark definition. OpenSCAP will then calculate flat score
during the evaluation.
Best regards,
--
Simon Lukasik
Security Technologies
--
SCAP Security Guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
https://github.com/OpenSCAP/scap-security-guide/