Hi all,
I´m new to snow, so please excuse a maybe stupid question.
We scanned our Linux Servers and i expected to find the installed rpm Packages in unassigned inventoried software.
The parameter software_scan_rpm in agent config ist set true.
Where can i find now the rpms in the inventory or licencse manager?
Thanks
Burkhard
Hi,
This is interesting actually, I have tried to tweak my Linux configuration file to make use of the include and exclude sections, but I didn’t manage to get it to pick up what I was looking for. I think it works according to the file type rather than by filename extension? From memory, there was an example in the documentation, but the agent already picked up those files, so adding it to my config made no difference.
If anyone has a good config example of scanning for custom files on Linux, I’d love to see it.
Thanks, David
Hi David,
yes you are right, in the end it comes down to a certain file type, not extension. At least if you use the default configuration.
This the way it is supposed to work. Config first, explanation after.
<Include>
<Path recursive="true" unconditionally="false">/*</Path>
</Include>
First of all, we tell the agent what to include in the software scan. In this case we include all directories and sub directories starting from the root. This is a VERY generous default config and can lead to some extreme scan times and file sizes.
(recursive=true means go through all sub directories, Unconditionally=true means ignore any excludes that might be present later on in the config. It is a bad idea to have unconditionally=yes.)
<Exclude>
<!-- Normal temporary directories on Unix systems. -->
<Path>/tmp*</Path>
<Path>/var/tmp*</Path>
<!-- Oracle audit files can be numerous. -->
<Path>*/oracle/*/audit*</Path>
<!-- Common non-relevant file extensions -->
<Path>*.au</Path>
<Path>*.bmp</Path>
<Path>*.bmu</Path>
<Path>*.cfg</Path>
...
...
In the exclude section you then configure what to deduct from the include statement.
In this case we make an exception for three paths, and also skip files with a certain file ending. (File endings are not a must in linux, so this works more like a rough filter to exclude a bulk of the irrelevant files for the final step, extracting the executables:
<IncludeCriteria enabled="true">
<FileType>ELF*executable*</FileType>
</IncludeCriteria>
From the complete list of files created by the include and exclude statements we now try to identify which files are executables. These are the ones we really want to write to the snowpack file. So we need to check the property of each file in our list to see if it is of the type ELF executable. If it is, we will save it to the snowpack file. If it isn't we will discard it from the scan result.
So if the files you are looking for are not ELF executables, they will not make it to the snowpack file. At least not using the deafult config.
Hi Martin,
thanks for your hints. That helped me.
But with this information I now found out, that not all rmp databases on our system are read.
Rpm packages in root rpmd database are recognized and information is additionally taken into account in the unassigned inventoried software list (e.g. version, same name for all excecutables which come with this rpm).
So next challange is to scan an additional rpm database on the linux system - for some reasons we use beneath root another user and rpm database for rpm installs.
Do you have an idea for this problem?
Thanks
Burkhard
There are not many settings for package management in the snow agent unfortunately. You can switch it on or off, but that is basically it.
I am not that familiar with rpm but I assume that there is a switch for rpm to connect to another database than the default one? In that case I think we hit a dead end as there is no way to pass such an argument to the agent.
On the other hand, if it is a user context matter, you might be able to run the agent with the root cron first, and a user cron after that to fetch the specific users rpm packages.
It might not be an ideal solution though, and might not even work. To have this working out of the box I would post this as a product enhancement idea here in the community.
"On the other hand, if it is a user context matter, you might be able to run the agent with the root cron first, and a user cron after that to fetch the specific users rpm packages. "
I just realized that this is not a good idea. The two scan results will just overwrite each other in the inventory database.
I am sorry to say that I cannot think of a good way so solve this with the current agent.
Ok, thanks so far. Then I will try to post it as product enhancement request.
Kind regards
Burkhard
Hello Burkhard,
The setting software_scan_rpm is toggling whether we use the RPM package manager or not during the software scan.
If this setting is set to true the agent will traverse the RPM package manager and locate meta data and installation paths for installed software, but it will not report the RPM packages as such.
If you want the agent to also report RPM files, you might have to tweak your configuration file a bit and investigate the include and exclude sections of the software scan, to make sure that you include the file types and paths that matches your RPM packages.