intermittent failure of oval check, how to debug?

Maura Dailey maura at eclipse.ncsc.mil
Wed Jun 19 16:35:43 UTC 2013


On 06/19/2013 12:29 PM, Brian Millett wrote:
> Ok, how do I go about debugging this:
>
> [root at deckard scap]# ./testcheck.py dir_perms_world_writable_sticky_bits.xml
> Evaluating with OVAL tempfile : /tmp/dir_perms_world_writable_sticky_bitshof67c.xml
> OpenSCAP Error: Unable to receive a message from probe [oval_probe_ext.c:583]
> [root at deckard scap]# ./testcheck.py dir_perms_world_writable_sticky_bits.xml
> Evaluating with OVAL tempfile : /tmp/dir_perms_world_writable_sticky_bitsLT_H5A.xml
> OpenSCAP Error: Unable to receive a message from probe [oval_probe_ext.c:583]
> [root at deckard scap]# ./testcheck.py dir_perms_world_writable_sticky_bits.xml
> Evaluating with OVAL tempfile : /tmp/dir_perms_world_writable_sticky_bits6eM3gu.xml
> OpenSCAP Error: Unable to receive a message from probe [oval_probe_ext.c:583]
> [root at deckard scap]# ./testcheck.py dir_perms_world_writable_sticky_bits.xml
> Evaluating with OVAL tempfile : /tmp/dir_perms_world_writable_sticky_bitsIWHsj4.xml
> Definition oval:scap-security-guide.testing:def:100: false
>
>
> The dir_perms_world_writable_sticky_bits test on ONE rhel6 machine is failing, but
> sometimes it does not.
>
> When I run an evaluation with the stig-rhel policy, I get
>
> OpenSCAP Error: Unable to receive a message from probe [oval_probe_ext.c:584]
> No definition with ID: oval:ssg:def:509 in result model. [oval_agent.c:182]
>

Two quick checks:
   - What version of openscap are you running? Is your ONE machine 
running a different version?
   - Does the output file in /tmp get created, and if so, does it have 
any clues?

- Maura Dailey


More information about the scap-security-guide mailing list