If you're familiar with DISA STIGs, the test for RHEL-06-000518 is

/bin/rpm -Va 2>/dev/null \
  | /bin/grep '^.M'

What I want to do is pull just the file name out of that test, and make pretty output with the package name and the offending file. However, my awk isn't doing it. Here's what I'm trying:

/bin/rpm -Va 2>/dev/null \
  | grep '^.M' \
  | awk '{print ($2 ~ /./ ? $3 : $2)}'

which, in theory, tells awk to print field 3 if field 2 is one of the single-character file types (%config, %documentation, etc., see the rpm man page)

However, what I get is the file name if-and-only-if ($2 ~ /./). Otherwise, I just get a blank line, even if I substitute $0 for that final $2.

What am I missing?


Your test $2 ~ /./ is always true, except when $2 is the empty string, ie when there is 0 or 1 field in the line. You should try $2 ~ /^.$/.

You can also combine the grep and awk into one:

 awk '/^.M/ {print ($2 ~ /^.$/ ? $3 : $2)}'
|improve this answer|||||
  • That did it. Thank you! Regarding the modified awk, the next STIG in the series, 000519, does something similar. However, I don't want to deviate too much from the test-as-given, so I don't confuse any code review folks, auditors, etc... – dafydd Apr 8 '16 at 17:31
  • ok. don't forget the anchor ^ in the grep: grep '^.M', to match only the 2nd char in the line. – meuh Apr 8 '16 at 17:34
  • Whoops! The does does have the '^.M'. I just neglected to type that character when I typed the question. :) Edited and fixed. – dafydd Apr 8 '16 at 17:36
  • good answer. An alternative (perhaps slightly faster too) to $2 ~ /^.$/ is length($2) == 1 – iruvar Apr 9 '16 at 1:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.