By default, on RHEL5, this setting is no. But there is no parameters "setting not found" and my control statistic is distorted.
Is there a regex for solve this issue or do I write a new control ?
I have forwarded your request to add a checkbox for setting not found to CID 2237 to engineering.
There are two internal projects related to this request that we refer to as Mask Pi/GR and Fixed Value.
Mask Pi/GR - when a scan is searching for a configuration setting but the file path or file that setting exists in are not found, the scanner returns "null". The numeric value development uses to represent null is either Pi or Golden Ratio (GR) depending on whether the file or file path were missing. Pi/GR Mask means that we replace the integer string of Pi/GR with text such as "Setting Not Found" in the reports.
Fixed Value - Rather than require customers to enter in Pi/GR values into the PERL regex, we have been porting our controls over to use checkboxes (aka, Fixed Value). In these fixed value options, you will see the use of checkboxes for options such as file not found, setting not found, user right not assigned, etc. These all basically allow customers to dictate whether the control passes or failes if null is returned as the default value is to fail if null is returned.
You can configure a control that has not yet been ported to fixed balue to pass on setting not found (aka GR) but will have to use the Pi/GR method.
When entering your expected control value in the policy, as in the default "no" you specified, you would also use pipe (|) or colon (:) between the values of your expected value, Pi, and GR.
Or more accurately, your expected value would be: no|161803399999999|314159265358979
This is PERL regulator expression based, so a similar value migh be:
I liked to use a web based tool called Regexpal.com to test my expected control values against what values are returned in the compliance report.
Here is an example of the above regex matching against the GR value:
I have asked for the dev team to port this control to fixed value if applicable. They responded that it looks pretty straigtforward, so you may have a checkbox option for "Setting Not Found" soon. Until then, the above method will work for this control if you need a method right now.
Let me know if this adequately answers your question.
Play with inverse operators !
Retrieving data ...