file-age syntax

[marcel.wiechmann@…]

Hi,

i have some problems with the fileage support and the nightly (NSClient++-20070304-2220). Dunno if it is working with previous versions, i only tested this one.

./check_nt -H 172.20.100.32 -p 1248 -v FILEAGE -l "c:\\daten\\access\\warnung.txt" -w 5 -c 6

Thursday, January 01, 1970 00:29:06

The Time is "correct" the file was 29 Minutes old but the rest (year,hour,time) ;)

The main problem is that the tool always result a OK state.
Maybe i make a mistake?

2007-03-05 12:59:10: debug:.\NSClientListener.cpp:124: Data: None&9&c:\daten\access\warnung.txt
2007-03-05 12:59:10: debug:.\NSClientListener.cpp:149: Data: c:\daten\access\warnung.txt
2007-03-05 12:59:10: debug:.\NSClient++.cpp:370: Injecting: getFileAge: path=c:\daten\access\warnung.txt
2007-03-05 12:59:10: debug:.\NSClient++.cpp:390: Injected Result: OK  --  1749&Thursday, January 01, 1970 00:29:09
2007-03-05 12:59:10: debug:.\NSClient++.cpp:391: Injected Performance Result: 

[mickem]

Uhmm, seems I returned "minutes" and not seconds to the check_nt client and thus the values were 60 times to large.

Will be fixed in latest nightly (later tonight), hope this works better...

MickeM

[mickem]

uhmm.. actually I meant the other way around... i returned seconds and not minutes :)

MickeM

[anonymous]

Thanks,

but you should announce that you changed seconds to minutes or some people will have a problem ;)

And i think that minutes are the correct way since the old NSClient used it too.

[Phil]

Version 2.7 still doesn't work

2007-03-06 23:23:42: debug:.\NSClientListener.cpp:141: Data: None&9&C:\Program Files\Common Files\Network Associates\Engine\scan.dat
2007-03-06 23:23:42: debug:.\NSClientListener.cpp:166: Data: C:\Program Files\Common Files\Network Associates\Engine\scan.dat
2007-03-06 23:23:42: debug:.\NSClient++.cpp:370: Injecting: getFileAge: path=C:\Program Files\Common Files\Network Associates\Engine\scan.dat
2007-03-06 23:23:42: debug:.\NSClient++.cpp:390: Injected Result: OK -- 1093&Thursday, January 01, 1970 18:13:42
2007-03-06 23:23:42: debug:.\NSClient++.cpp:391: Injected Performance Result:

The correct answer is "Tuesday March 06, 2007 05:10:00"

Phil

[anonymous]

Humm... the checking works properly right? (in other words the -w and -c limits are correct?

The string is just a "string" as for the format, it returns the "age" of the file (sadly in a broken format), maybe you want it to return when the file was last updated?
I do not know how pNSclient works, and sadly it no longer works on my computer at home so I cannot verify it. But I can add an option to set the return format to be either: age in a better format (as in: "3 days, 12 hours and 334 minuts ago") or the date of the file (as in: "Tuesday March 06, 2007 05:10:00").

Which would be preferable?

MickeM

[Phil]

File date is always preferable, in my opinion.

I tried checking file age with both the standard plugins' check_nt and the check_nt which came with pNSClient.exe. Neither returned the correct date and time.

pNSClient appends after the filename in the request something like

,"Date: %Y-%m-%d %H:%M:%S"

where the date string is user configurable.

I don't think it is possible to be compatible with both versions of check_nt, so I'd stick with the standard plugins version of check_nt.

I personally would prefer the date to be returned in ISO standard yyyy-mm-dd hh:mm:ss
format, but that's your call.

And looking at my antivirus "dat" files, it's the modified date you should be checking, not creation date.

Thanks,

Phil

[anonymous]

Replying to Phil:

pNSClient appends after the filename in the request something like

,"Date: %Y-%m-%d %H:%M:%S"

where the date string is user configurable.

Oops, I meant that the pNSClient's check_nt takes that extra parameter. I'm not sure if the extra part is passed on to pNSClient.exe on the queried host - I think not. I think pNSClient returns the date as a Unix date format number which is translated back into the specified form by the pnsClient-specific check_nt.

Not worth bothering about.

[anonymous]

Architecture Japanese architecture

[anonymous]

This bug is still not fixed, returns bogus date

[mickem]

fixed in next build...

append: .<date string> if you want to use a "custom date" like so: ... -v FILEAGE -l c:
windows,Date: %Y-%m-%d %H:%M:%S" -w 5 -c 6 ...
Only the above listed %<char> works, and default to 0 so might not be to pretty but works...

[anonymous]

We could still do with a way to return the file's datestamp instead of the file's "age". The original NSClient and pNSClient returned a date stamp in the result string, not the age.

[anonymous]

Hum, I shall add an option for it (but not in the 0.3.0 rel that will come out tomorrow)
Would we want default to be "files date" or "files age" ?

MickeM

[anonymous]

File date was the original NSClient output, so that should be the default, I guess.

Thanks very much.