One thing to add: processes are first selected by the name in the promise, and then by process_select (which may be missing, in which case you just get what was in the promise). All other actions are in the promise.
So typically, you'd do one of two things: 1) Select "foo" in your promise name, or 2) Select ".*" in your promise name and then "foo" in process_select You can revise this - for example, you might want to select "foo" in the promise, and then use process_select to find those that had a high ttime; but since you can also select "foo" in the command name of the promise, most people don't do this "mixed selection" thing. Basicaly, process_select is for advanced selection, the promise name is for simple name-based-only selection. -Dan On May 13, 2011, at 1:24 AM, Seva Gluschenko wrote: > Aleksey, > > your question is pretty well covered here: > > http://www.cfengine.org/manuals/cf3-reference.html#processes-in-agent-promises > > say, if you want to terminate suspicious process, just kill it: > > ".*" > process_select => proc_finder("$(suspicious_process_names)"), > signals => { "kill" }; > > (Be accurate with your process selector, though.) > > 2011/5/13 Aleksey Tsalolikhin <atsaloli.t...@gmail.com>: >> So I'm looking for a practical example of how process_select could be >> used. What do you do after the selection has been made? How do you >> report the process names or take actions (signal or process_stop >> them?) >> >> For example, I have this policy that will match on suspicious process >> names, but then what? >> >> bundle agent example >> >> { >> >> vars: >> >> "suspicious_process_names" slist => >> { >> "sniff", >> "eggdrop", >> "r00t", >> "^\./", >> "john", >> "crack" >> }; >> >> >> processes: >> >> ".*" >> >> process_select => >> proc_finder("$(suspicious_process_names)"); >> } >> >> >> ######################################################## >> >> body process_select proc_finder(pattern) >> >> { >> command => ".*$(pattern).*"; >> >> process_result => "command"; >> } >> _______________________________________________ >> Help-cfengine mailing list >> Help-cfengine@cfengine.org >> https://cfengine.org/mailman/listinfo/help-cfengine >> > > > > -- > SY, Seva Gluschenko. > _______________________________________________ > Help-cfengine mailing list > Help-cfengine@cfengine.org > https://cfengine.org/mailman/listinfo/help-cfengine _______________________________________________ Help-cfengine mailing list Help-cfengine@cfengine.org https://cfengine.org/mailman/listinfo/help-cfengine
