intermittent failure of oval check, how to debug?

Simon Lukasik isimluk at fedoraproject.org
Wed Aug 21 07:11:01 UTC 2013


On 06/19/2013 06:29 PM, Brian Millett wrote:
> 
> Ok, how do I go about debugging this:
> 
> [root at deckard scap]# ./testcheck.py dir_perms_world_writable_sticky_bits.xml 
> Evaluating with OVAL tempfile : /tmp/dir_perms_world_writable_sticky_bitshof67c.xml
> OpenSCAP Error: Unable to receive a message from probe [oval_probe_ext.c:583]
> [root at deckard scap]# ./testcheck.py dir_perms_world_writable_sticky_bits.xml 
> Evaluating with OVAL tempfile : /tmp/dir_perms_world_writable_sticky_bitsLT_H5A.xml
> OpenSCAP Error: Unable to receive a message from probe [oval_probe_ext.c:583]
> [root at deckard scap]# ./testcheck.py dir_perms_world_writable_sticky_bits.xml 
> Evaluating with OVAL tempfile : /tmp/dir_perms_world_writable_sticky_bits6eM3gu.xml
> OpenSCAP Error: Unable to receive a message from probe [oval_probe_ext.c:583]
> [root at deckard scap]# ./testcheck.py dir_perms_world_writable_sticky_bits.xml 
> Evaluating with OVAL tempfile : /tmp/dir_perms_world_writable_sticky_bitsIWHsj4.xml
> Definition oval:scap-security-guide.testing:def:100: false
> 
> 
> The dir_perms_world_writable_sticky_bits test on ONE rhel6 machine is failing, but
> sometimes it does not.
> 
> When I run an evaluation with the stig-rhel policy, I get
> 
> OpenSCAP Error: Unable to receive a message from probe [oval_probe_ext.c:584]
> No definition with ID: oval:ssg:def:509 in result model. [oval_agent.c:182]
> 

Hello Brian,

When this happens, we tend to rebuilt the package with debugging
information and re-run. There are some notes for debugging at

    http://www.open-scap.org/page/Debug

Basically, when the debug is on, each process of OpenSCAP creates its
own file oscap_debug.log.<PID>. One of the files will be from the probe
which is dying. There might be some clue in the file.

If you don't fell like debugging, and your issue is reproducible on
another set-up, you can share your files with OpenSCAP mailing list.

Off course, the best option is to open a support ticket with your
software provider.

Best regards,

-- 
Simon Lukasik
Security Technologies


More information about the scap-security-guide mailing list