File: cf3-reference.html

package info (click to toggle)
cfengine3 3.0.5%2Bdfsg-1
links: PTS, VCS
area: main
in suites: squeeze
size: 10,452 kB
ctags: 6,615
sloc: ansic: 62,933; sh: 9,712; yacc: 347; makefile: 287; sql: 23
file content (26282 lines) | stat: -rw-r--r-- 872,436 bytes
<html lang="en">
<head>
<title>Cfengine reference manual</title>
<meta http-equiv="Content-Type" content="text/html">
<meta name="description" content="Cfengine reference manual">
<meta name="generator" content="makeinfo 4.12">
<link title="Top" rel="top" href="#Top">
<link href="http://www.gnu.org/software/texinfo/" rel="generator-home" title="Texinfo Homepage">
<meta http-equiv="Content-Style-Type" content="text/css">
<style type="text/css"><!--
  pre.display { font-family:inherit }
  pre.format  { font-family:inherit }
  pre.smalldisplay { font-family:inherit; font-size:smaller }
  pre.smallformat  { font-family:inherit; font-size:smaller }
  pre.smallexample { font-size:smaller }
  pre.smalllisp    { font-size:smaller }
  span.sc    { font-variant:small-caps }
  span.roman { font-family:serif; font-weight:normal; } 
  span.sansserif { font-family:sans-serif; font-weight:normal; } 
h1, h2, a, table.list th
{
    color: #1f6e6b;
}

.node
{ 
background: #ddd url(Logo2-small.png) right no-repeat;
}

.menu
{  
background: #eef url(menu.png) right no-repeat;
}

.contents
{
background-color: #e9f4e9; 
}

.index-cp
{  
background: #fff url(index-cp.png) right repeat-y;
}

.index-vr
{  
background: #fff url(index-vr.png) right repeat-y;
}

.index-mb
{  
background: #eee url(index-faq.png) right repeat-y;
}

table.border
{ 
  border-color: #4e8b8c;
  border-style: solid;
  border-width: 1px;
}

BODY {
     font-family: Verdana, Arial, Helvetica, sans-serif;
     font-style: normal;
     font-size: 11pt;
     background: #FFFFFF;
     color: #000000;
     }
        
P { 
  font-family: Verdana, Arial, Helvetica, sans-serif;
  }

FONT.liten {font-size: 70%; }

H1, H2, H3 {
        font-weight: normal;
        color: #2c2e70;
        margin-bottom: 0em;
        }

TABLE { vertical-align: top; } 

H1 { font-size: 140% }
H2 { font-size: 120% }
H3 { font-size: 110% }
H4 { font-style: italic; }

TD, TH, UL {
        font-family: Verdana, Arial, Helvetica, sans-serif;
        font-style: normal;
        }

TH { background: #9999FF;
     font-family: Verdana, Arial, Helvetica, sans-serif;
     color: blue;
  font-size: 10pt;
   }

TD { color: #000000;
     font-family: Verdana, Arial, Helvetica, sans-serif;
     font-size: 10pt;
   }

PRE { font-family: "Lucida Typewriter", "Courier", monotype;
      font-style: normal;
     font-size: 11pt;
background-color: #eee;
    }
 
.tynn {
        font-family: Arial, Helvetica, sans-serif;
        font-size: smaller;
        font-style: normal;
        font-weight: lighter;
        margin-bottom: 0em;
     font-size: 11pt;
        }

A:link { color: #2c2e70 }
A:visited { color: black }
A:active { color: #600041 }
--></style>
</head>
<body>
<h1 class="settitle">Cfengine reference manual</h1>
<div class="node">
<p><hr>
<a name="Top"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Getting-started">Getting started</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#dir">(dir)</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#dir">(dir)</a>

</div>

<h2 class="unnumbered">Cfengine-AutoReference</h2>

   <p><a href="#Contents"><h1>COMPLETE TABLE OF CONTENTS</h1></a>
<h2>Summary of contents</h2><!-- ***************************************************** -->
<!-- * CHAPTER -->
<!-- ***************************************************** -->

<ul class="menu">
<li><a accesskey="1" href="#Getting-started">Getting started</a>
<li><a accesskey="2" href="#A-simple-crash-course">A simple crash course</a>
<li><a accesskey="3" href="#How-to-run-cfengine-3-examples">How to run cfengine 3 examples</a>
<li><a accesskey="4" href="#A-complete-configuration">A complete configuration</a>
<li><a accesskey="5" href="#Control-Promises">Control Promises</a>
<li><a accesskey="6" href="#Bundles-for-common">Bundles for common</a>
<li><a accesskey="7" href="#Bundles-for-agent">Bundles for agent</a>
<li><a accesskey="8" href="#Bundles-for-server">Bundles for server</a>
<li><a accesskey="9" href="#Bundles-for-knowledge">Bundles for knowledge</a>
<li><a href="#Bundles-for-monitor">Bundles for monitor</a>
<li><a href="#Special-functions">Special functions</a>
<li><a href="#Special-Variables">Special Variables</a>
<li><a href="#Logs-and-records">Logs and records</a>
</ul>

<div class="node">
<p><hr>
<a name="Getting-started"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#A-simple-crash-course">A simple crash course</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Top">Top</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Top">Top</a>

</div>

<h2 class="chapter">1 Cfengine 3.0.2 &ndash; Getting started</h2>

<p><br>

   <p>Cfengine is a suite of programs for integrated autonomic management of
either individual or networked computers. It has existed as as
software suite since 1993 and this version published under the GNU
Public License (GPL v3) and a Commercial Open Source License (COSL). 
Cfengine is Copyright by <b>Cfengine AS</b>, a company founded by cfengine
author Mark Burgess.

   <p>This document describes version 3 of cfengine, which is a radical
departure from earlier versions. It is both simpler and more powerful. 
Cfengine 3 will exist in four versions, each of which adds to the fo

     <ul>
<li><b>Community Edition</b> - a free and gratis core of the software (available now). 
<li><b>Nova</b> - a commercial enhanced version for basic enterprise needs (available now). 
<li><b>Constellation</b> - a commercial enhancement for larger enterprises (coming 2010). 
<li><b>Galaxy</b> - the ultimate commerical enhancement for global enterprises (coming 2011). 
</ul>

   <p>Cfengine 3 has been changed to be both a more powerful tool and a much
simpler tool. Cfengine 3's language interface is not backwards
compatible with the cfengine 2 configuration language, but it
interoperates with cfengine 2 so that it is "run-time compatible". 
This means that you can change over to version 3 slowly, with low risk
and at your own speed.

   <p>With cfengine 3 you can install, configure and maintain computers
using powerful hands-free tools. You can also integrate knowledge
management and diagnosis into the processes.

   <p>Cfengine differs from most management systems in being

     <ul>
<li>Open software (GPL or COSL). 
<li>Lightweight and generic. 
<li>Non-reliant on a working network to function correctly. 
<li>Capable of making each and every host autonomous
</ul>

   <p>Cfengine 3 consists of a number of components:

     <dl>
<dt><code>cf-agent</code><dd>Active agent
<br><dt><code>cf-execd</code><dd>Scheduler
<br><dt><code>cf-graph</code><dd>Graph data extractor
<br><dt><code>cf-know</code><dd>Knowledge modelling agent
<br><dt><code>cf-monitord</code><dd>Passive monitoring agent
<br><dt><code>cf-promises</code><dd>Promise validator
<br><dt><code>cf-runagent</code><dd>Remote run agent
<br><dt><code>cf-serverd</code><dd>Server agent
<br><dt><code>cf-report</code><dd>Self-knowledge extractor
</dl>

   <p>The starred components are new. The daemon formally called
<code>cfenvd</code> in previous versions of cfengine is now called
<code>cf-monitord</code>.

   <p>Unlike previous versions of cfengine, which had no consistent model
for its features, you can recognize <i>everything</i> in cfengine 3
from just a few concepts.

     <dl>
<dt><i>Promise</i><dd>A statement about the state we desire to maintain. 
<br><dt><i>Promise bundles</i><dd>A collection of promises. 
<br><dt><i>Promise bodies</i><dd>A part of a promise which details and constrains its nature. 
<br><dt><i>Data types</i><dd>An interpretation of a scalar value: string, integer or real number. 
<br><dt><i>Variables</i><dd>An association of the form "LVALUE <i>represents</i> RVALUE", where rval may be a scalar value or a list of scalar values. 
<br><dt><i>Functions</i><dd>Built-in parameterized rvalues. 
<br><dt><i>Classes</i><dd>Cfengine's boolean classifiers that describe context. 
</dl>

   <p>If you have used cfengine before then the most visible part of
cfengine 3 will be its new language interface.  Although it has been
clear for a long time that the organically grown language used in
cfengine 1 and 2 developed many problems, it was not immediately
clear exactly what would be better. It has taken years of research to
simplify the successful features of cfengine to a single overarching
model. To understand the new cfengine, it is best to set aside any
preconceptions about what cfengine is today. Cfengine 3 is a genuine
"next generation" effort, which is will be a springboard into the
future of system management.

<ul class="menu">
<li><a accesskey="1" href="#A-renewed-cfengine">A renewed cfengine</a>
<li><a accesskey="2" href="#Installation">Installation</a>
<li><a accesskey="3" href="#Work-directory">Work directory</a>
<li><a accesskey="4" href="#Hard-classes">Hard classes</a>
<li><a accesskey="5" href="#Global-and-local-classes">Global and local classes</a>
<li><a accesskey="6" href="#Filenames-and-paths">Filenames and paths</a>
<li><a accesskey="7" href="#Upgrading-from-cfengine-2">Upgrading from cfengine 2</a>
<li><a accesskey="8" href="#Testing-as-a-non_002dprivilieged-user">Testing as a non-privilieged user</a>
<li><a accesskey="9" href="#The-bare-necessities-of-a-cfengine-3">The bare necessities of a cfengine 3</a>
<li><a href="#Familiiarizing-yourself">Familiiarizing yourself</a>
<li><a href="#Remote-access-troubleshooting">Remote access troubleshooting</a>
</ul>

<div class="node">
<p><hr>
<a name="A-renewed-cfengine"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Installation">Installation</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Getting-started">Getting started</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Getting-started">Getting started</a>

</div>

<h3 class="section">1.1 A renewed cfengine</h3>

<p>Cfengine 3 is a significant rewrite of underlying cfengine technology
which preserves the core principles and methodology of cfengine's
tried and tested approach.  It comes with a new, improved language,
with a consistent syntax and powerful pattern expression features that
display the intent behind cfengine code more clearly. The main goal in
changing the language is to simplify and improve the robustness and
functionality without sacrificing the basic freedoms and self-repairing
concepts.

   <p>Cfengine 3's new language is a direct implementation of a model
developed at Oslo University College over the past four years, known
colloquially as "Promise Theory".  Promises were originally introduced
by Mark Burgess as a way to talk about cfengine's model of autonomy
and have since become a powerful way of modelling cooperative systems
&ndash; not just computers, but humans too.

   <blockquote>

   <p><i>   &ldquo;The biggest challenge of implementing cfengine in our organization<br>
     was not technical but political &ndash; getting everyone to agree.<br>
     Promise theory was a big help in understand this.&rdquo;</i>

   </blockquote>

   <p>Cfengine 3 is a generic implementation of the language of promises
that allows all of the aspects of configuration and change management to be
unified under a single umbrella.

   <p>Why talk about promises instead of simply talking about changes? After
all, the trend in business and IT management today is to talk about
Change Management (with capital letters), e.g. in the IT
Infrastructure Library (ITIL) terminology.  This comes from a long
history of process management thinking. But we are not really
interested in change &ndash; we are interested in avoiding it, i.e. being
in a state where we don't need to make any changes. In other words we
want to be able to promise that the system is correct, verify this and
only make changes if our promises are not kept. If you want
to think ITIL, think of this as a service that cfengine provides.

   <p>To put it another way, cfengine is not really a <i>change
management</i> system, it is a <i>maintenance system</i>. Maintenance
is the process of making small changes or corrections to a model. A
`model' is just another word for a template or a specification of how
we want the system to work. Cfengine's model is based on the idea of
promises, which means that it focuses on what is stable and lasting
about a system &ndash; not about what is changing.

   <p>This is an important philosophical shift. It means we are focused
mainly on what is right and not on what is wrong. By saying what
"right" is (the ideal state of our system) we are focused on the
actual behaviour. If we focus too much on the changes, i.e. the
differences between now and the future, we might forget to verify that what
we assume is working now in fact works.

   <p>Models that talk about change management tend to forget that after
every change there is a litany of <i>incidents</i> during which it is
necessary to repair the system or return it to its intended state. 
But if we know what we have promised, it is easy to verify whether the
promise is kept. 
This means that it is the <i>promises</i> about how the system should
be that are most important, not the actual changes that are made in
order to keep them.

<div class="node">
<p><hr>
<a name="Installation"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Work-directory">Work directory</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#A-renewed-cfengine">A renewed cfengine</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Getting-started">Getting started</a>

</div>

<h3 class="section">1.2 Installation</h3>

<p>In order to install cfengine, you should first ensure that the following
packages are installed.

     <dl>
<dt><b>OpenSSL</b><dd>Open source Secure Sockets Layer for encryption.<br>URL: <a href="http://www.openssl.org">http://www.openssl.org</a>
<br><dt><b>BerkeleyDB</b><span class="roman"> (version 3.2 or later)</span><dd>Light-weight flat-file database system.<br>URL: <a href="http://www.oracle.com/technology/products/berkeley-db/index.html">http://www.oracle.com/technology/products/berkeley-db/index.html</a>

     <br><dt><b>In addition...</b><dd>It is recommended to make the Perl Compatible Regular Expression
(PCRE) library available as this is a significant improvement over the
more standard POSIX libraries. This documentation assumes the use of
PCRE

     <br><dt><dd>On Windows machines, you need to install the basic Cygwin DLL from <a href="http://www.cygwin.com">http://www.cygwin.com</a>
in order to run cfengine. 
</dl>

   <p>Additional functionality becomes available if other libraries are present, e.g. 
OpenLDAP, client libraries for MySQL and PostgreSQL, etc. It is possible to run
cfengine without these, but related functionality will be missing.

   <p>Unless you have purchased ready-to-run binaries, or are using a
package distribution, you will need to compile cfengine. For this you
will also need a build environment tools: <code>gcc</code>, <code>flex</code>, <code>bison</code>.

<p class="noindent">The preferred method of installation is then

<pre class="smallexample">     tar zxf cfengine-x.x.x.tar.gz
     cd cfengine-x.x.x
     ./configure
     make
     make install
</pre>
   <p class="noindent">This results in binaries being installed in <samp><span class="file">/usr/local/sbin</span></samp>. 
Since this is not necessarily a local file system on all hosts, users
are encouraged to keep local copies of the binaries on each host, inside
the cfengine trusted work directory.

<div class="node">
<p><hr>
<a name="Work-directory"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Hard-classes">Hard classes</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Installation">Installation</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Getting-started">Getting started</a>

</div>

<h3 class="section">1.3 The work directory</h3>

<p>In order to achieve the desired simplifications, it was decided to
reserve a private work area for the cfengine tool-set. 
<!-- chew begin Work directory -->

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
In cfengine 1.x, the administrator could choose the locations of
configuration files, locks, and logging data independently. In
cfengine 2.x, this diversity has been simplified to a single directory
which defaults to <samp><span class="file">/var/cfengine</span></samp> (similar to <samp><span class="file">/var/cron</span></samp>), and in
cfengine 3.x this is preserved. 
</td></tr></table>

<!-- /@w --><pre class="smallexample">     /var/cfengine
     /var/cfengine/bin
     /var/cfengine/inputs
     /var/cfengine/outputs
</pre>
   <!-- chew end Work directory -->
   <p>The installation location
<samp><span class="file">/usr/local/sbin</span></samp> is not necessarily a local file system, and cannot
therefore be trusted to a) be present, and b) be authentic on an
arbitrary system.

   <p>Similarly, a trusted cache of the input files must now be maintained
in the <samp><span class="file">inputs</span></samp> subdirectory. When cfengine is invoked by the
scheduler, it reads only from this directory. It is up to the user to
keep this cache updated, on each host. This simplifies and
consolidates the cfengine resources in a single place.

   <p>Unlike cfengine 2, cfengine 3 does not recognize the
<code>CFINPUTS</code> environment variable.

   <p>The <samp><span class="file">outputs</span></samp> directory is now a record of spooled run-reports. These
are often mailed to the administrator by <code>cf-execd</code>, or can be copied
to another central location and viewed in an alternative browser.

<!--  -->
<!-- SECTION -->
<!--  -->
<div class="node">
<p><hr>
<a name="Hard-classes"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Global-and-local-classes">Global and local classes</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Work-directory">Work directory</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Getting-started">Getting started</a>

</div>

<h3 class="section">1.4 Cfengine hard classes</h3>

<p>Cfengine runs on every computer individually and each time it wakes up
the underlying generic agent platform discovers and classifies
properties of the environment or context in which it runs.  This information
is cached and may be used to make decisions about configuration<a rel="footnote" href="#fn-1" name="fnd-1"><sup>1</sup></a>.

   <p>Classes fall into hard (discovered) and soft (defined) types.  A
single class can be one of several things:

<!-- chew start Hard classes -->
     <ul>
<li>The name of an operating system architecture e.g.  <code>ultrix</code>, <code>sun4</code>, etc.

     <li>The unqualified name of a particular host. If your system returns a fully
qualified domain name for your host, cfengine truncates it at the first dot.

     <li>The name of a user-defined group of hosts.

     <li>A day of the week (in the form <code>Monday, Tuesday, Wednesday, ..</code>).

     <li>An hour of the day, current time zone (in the form <code>Hr00, Hr01 ... Hr23</code>).

     <li>An hour of the day GMT (in the form <code>GMT_Hr00, GMT_Hr01 ... GMT_Hr23</code>). 
This is consistent the world over, in case you need virtual simulteneity of change
coordination.

     <li>Minutes in the hour (in the form <code>Min00, Min17 ... Min45</code>).

     <li>A five minute interval in the hour (in the form <code>Min00_05, Min05_10 ... Min55_00</code>)

     <li>A day of the month (in the form <code>Day1, Day2, ... Day31</code>).

     <li>A month (in the form <code>January, February, ... December</code>).

     <li>A year (in the form <code>Yr1997, Yr2004</code>).

     <li>A shift in <code>Night,Morning,Afternoon,Evening</code>, which fall into six hour blocks
starting at 00:00 hours.

     <li>A `lifecycle index', which is the year number modulo 3 (used in long term resource memory).

     <li>An arbitrary user-defined string.

     <li>The IP address octets of any active interface (in the form <code>ipv4_192_0_0_1<!-- /@w --></code>,
<code>ipv4_192_0_0<!-- /@w --></code>, <code>ipv4_192_0<!-- /@w --></code>, <code>ipv4_192<!-- /@w --></code>).

   </ul>

<!-- chew end Hard classes -->
   <p>To see all of the classes define on a particular host, run

<pre class="smallexample">     host# cf-promises -v
</pre>
   <p>as a privileged user. Note that some of the classes are set only
if a trusted link can be established with cfenvd, i.e. if both
are running with privilege, and the <samp><span class="file">/var/cfengine/state/env_data</span></samp>
file is secure. More information about classes can be found in connection with
<code>allclasses</code>.

<!--  -->
<!-- SECTION -->
<!--  -->
<div class="node">
<p><hr>
<a name="Global-and-local-classes"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Filenames-and-paths">Filenames and paths</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Hard-classes">Hard classes</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Getting-started">Getting started</a>

</div>

<h3 class="section">1.5 Global and local classes</h3>

<p>Classes are defined in bundles. Bundles of type <code>common</code> yield classes that
are global in scope, whereas in all other bundle types classes are local. 
Classes are evaluated when the bundle is evaluated. 
Consider the following example.

<pre class="verbatim">
body common control
{
bundlesequence => { "g","tryclasses_1", "tryclasses_2" };
}

#################################

bundle common g
{
classes:

  "one" expression => "any";

}

#################################

bundle agent tryclasses_1
{
classes:

  "two" expression => "any";
}

#################################

bundle agent tryclasses_2
{
classes:

  "three" expression => "any";

reports:

  one.three.!two::

    "Success";
}

</pre>

   <p>Here we see that class &lsquo;<samp><span class="samp">one</span></samp>&rsquo; is global while classes &lsquo;<samp><span class="samp">two</span></samp>&rsquo; and &lsquo;<samp><span class="samp">three</span></samp>&rsquo; are local. 
The report `Success' result is therefore true because only &lsquo;<samp><span class="samp">one</span></samp>&rsquo; and &lsquo;<samp><span class="samp">three</span></samp>&rsquo; are in scope.

<!--  -->
<!-- SECTION -->
<!--  -->
<div class="node">
<p><hr>
<a name="Filenames-and-paths"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Upgrading-from-cfengine-2">Upgrading from cfengine 2</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Global-and-local-classes">Global and local classes</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Getting-started">Getting started</a>

</div>

<h3 class="section">1.6 Filenames and paths</h3>

<!-- chew start Unix filenames -->
<p>Filenames in Unix-like operating systems use the forward slash
&lsquo;<samp><span class="samp">/</span></samp>&rsquo; character for their directory separator . All references to
file locations must be absolute pathnames in cfengine, i.e. they must
begin with a complete specification of which directory they are
in. For example:

<pre class="smallexample">     /etc/passwd
     /usr/local/masterfiles/distfile
</pre>
   <p class="noindent">The only place where it makes sense to refer to a file without a complete
directory specification is when searching through directories for different
kinds of file, e.g. in pattern matching

<pre class="verbatim">
leaf_name => { "tmp_.*", "output_file", "core" };

</pre>

<p class="noindent">Here, one can write <samp><span class="file">core</span></samp> without a path, because one is looking for any
file of that name in a number of directories. 
<!-- chew end Unix filenames -->

<!-- chew start Windows filenames -->
   <p>The Windows operating systems traditionally use a different filename
convention.  The following are all valid absolute file names under
Windows:

<pre class="smallexample">      c:\winnt
      c:/winnt
      /var/cfengine/inputs
      //<var>fileserver</var>/share2/dir
</pre>
   <p>The `drive' name &ldquo;C:&rdquo; in Windows refers to a partition or device. Unlike Unix,
Windows does not integrate these seamlessly into a single file-tree. 
This is not a valid absolute filename:

<pre class="smallexample">     \var\cfengine\inputs
</pre>
   <p>Paths beginning with a backslash are assumed to be win32 paths.  They
must begin with a drive letter or double-slash server name. 
<!-- chew end Windows filenames -->

   <p>Note in recent versions of Cygwin you can decide to use the
<code>/cygdrive</code> to specify a path to windows file E.g
<samp><span class="file">/cygdrive/c/myfile</span></samp> means <samp><span class="file">c:\myfile</span></samp> or you can do it straight away in
cfengine as <code>c:\myfile</code>.

<!--  -->
<div class="node">
<p><hr>
<a name="Upgrading-from-cfengine-2"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Testing-as-a-non_002dprivilieged-user">Testing as a non-privilieged user</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Filenames-and-paths">Filenames and paths</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Getting-started">Getting started</a>

</div>

<h3 class="section">1.7 Upgrading from cfengine 2</h3>

<p>Cfengine 3 has a completely new syntax, designed to solve the issues
brought up from 15 years of experience with configuration
management. Rather than clutter cfengine 3 with buggy
backward-compatability issues, it was decided to make no compromises
with cfengine 3 and instead allow cfengine 2 and cfengine 3 to
coincide in a cooperative fashion for the foreseeable future.  This
means that users can upgrade at their own pace, in the classic
cfengine incremental fashion. We expect that cfengine 2 installations
will be around for years to come so this upgrade path seems the most
defensible.

   <p>The daemons and support services are fully interoperable between
cfengine 2 and cfengine 3, so it does not matter whether you run
<code>cfservd</code> (cf2) together with <code>cf-agent</code> (cf3) or
<code>cf-serverd</code> (cf3) together with <code>cfagent</code> (cf2). You can
change the servers at your own pace.

   <p>Cfengine 3's <code>cf-execd</code> replaces cfengine 2's <code>cfexecd</code> and
it is designed to work optimally with <code>cf-agent</code> (cf3). Running
this daemon has no consequences for access control, only for
scheduling <code>cf-agent</code>. You can (indeed should) replace
<code>cfexecd</code> with <code>cf-execd</code> immediately. You will want to
alter your <samp><span class="file">crontab</span></samp> file to run the new component instead of the
old. The sample cfengine 3 input files asks <code>cf-agent</code> to do
this automatically, simply replacing the string.

   <p>The sample <samp><span class="file">inputs</span></samp> files supplied with cfengine 3 contain
promises to integrate cfengine 2 as described. What can you do to
upgrade? Here is a simple recipe that assumes you have a standardized
cfengine 2 setup, running <code>cfexecd</code> in <samp><span class="file">crontabs</span></samp> and possibly
running <code>cfservd</code> and <code>cfenvd</code> as daemons.

     <ol type=1 start=1>

     <li>Install the cfengine 3 software on a host.

     <li>Go to the <samp><span class="file">inputs/</span></samp> directory in the source and copy these
files to your master update repository, i.e.  where you will publish
policies for distribution.

     <li>Remove any self-healing rules to reinstall cfengine 2, especially
rules to add <code>cfexecd</code> or <code>cfagent</code> to <samp><span class="file">crontabs</span></samp> etc. Cfengine 3
will handle this from now on and encapsulate old cfengine 2 scripts.

     <li>Move to this inputs directory: <code>cd </code><var>your-path</var><code>/inputs</code>.

     <li>Set the location of this master update directory in the <samp><span class="file">update.cf</span></samp>
file to the location of the master directory.

     <li>Set the email options for the executor in <samp><span class="file">promises.cf</span></samp>.

     <li>Run <code>cf-agent --bootstrap</code> as the root or privileged user. This will install
cfengine 3 in place of cfengine 2, integrate your old cfengine 2
configuration, and warn you about any rules that need to be removed
from your old cfengine configuration.

     <li>You should now be running cfengine 3. You can now add new rules to the files
in your own time, or convert the old cfengine 2 rules and gradually comment them
out of the cfengine 2 files.

     <li>Make sure there are no rules in your old cfengine 2 configuration to activate
cfengine 2 components, i.e. rules that will fight against cfengine 3. 
Then, when you are ready, convert <samp><span class="file">cfservd.conf</span></samp> into a server bundle e.g. in <samp><span class="file">promises.cf</span></samp>
and remove all rules to run <code>cfservd</code> and replace them with rules to run
<code>cf-serverd</code> at your own pace.

        </ol>

<!--  -->
<div class="node">
<p><hr>
<a name="Testing-as-a-non-privilieged-user"></a>
<a name="Testing-as-a-non_002dprivilieged-user"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#The-bare-necessities-of-a-cfengine-3">The bare necessities of a cfengine 3</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Upgrading-from-cfengine-2">Upgrading from cfengine 2</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Getting-started">Getting started</a>

</div>

<h3 class="section">1.8 Testing as a non-privilieged user</h3>

<p>One of the practical advantages of cfengine is that you can test it
without the need for root or administrator privileges. This is
recommended for all new users of cfengine 3.

   <p>Cfengine operates with the notion of a work-directory. The default
work directory for the <code>root</code> user is <samp><span class="file">/var/cfengine</span></samp>
(except on Debian Linux and various derivatives which prefer
<samp><span class="file">/var/lib/cfengine</span></samp>).  For any other user, the work directory
lies in the user's home directory, named <samp><span class="file">~/.cfagent</span></samp>. Cfengine
prefers you to keep certain files here.  You should not resist this
too strongly or you will make unnecessary trouble for yourself.  The
decision to have this `known directory' was made to simplify a lot of
configuration.

   <p>To test cfengine as an ordinary user, do the following:

     <ul>
<li>Compile and make the software. 
<li>Copy the binaries into the work directory:
     <pre class="smallexample">          host$ mkdir -p ~/.cfagent/inputs
          host$ mkdir -p ~/.cfagent/bin
          host$ cd src
          host$ cp cf-* ~/.cfagent/bin
          host$ cd ../inputs
          host$ cp *.cf ~/.cfagent/inputs
</pre>
     </ul>

   <p>You can test the software and play with configuration files by editing the basic get-started files
directly in the <samp><span class="file">~/.cfagent/inputs</span></samp> directory. For example, try the following:

<pre class="smallexample">     host$ ~/.cfagent/bin/cf-promises
     host$ ~/.cfagent/bin/cf-promises --verbose
</pre>
   <p>This is always the way to start checking a configuration in cfengine
3. If a configuration does not pass this check/test, you will not be
allowed to use it, and <samp><span class="file">cf-agent</span></samp> will look for the file
<samp><span class="file">failsafe.cf</span></samp>.

   <p>Notice that the cfengine 3 binaries have slightly different names than the cfengine
2 binaries. They all start with the <samp><span class="file">cf-</span></samp> prefix.
<pre class="smallexample">     host$ ~/.cfagent/bin/cf-agent
</pre>
   <!--  -->
<div class="node">
<p><hr>
<a name="The-bare-necessities-of-a-cfengine-3"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Familiiarizing-yourself">Familiiarizing yourself</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Testing-as-a-non_002dprivilieged-user">Testing as a non-privilieged user</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Getting-started">Getting started</a>

</div>

<h3 class="section">1.9 The `bear' necessities of a cfengine 3</h3>

<p>Here is the simplest `Hello world' program in cfengine 3:

<pre class="verbatim">
body common control
{
bundlesequence  => { "test" };
}

bundle agent test
{
reports:

 Yr2009::
    "Hello world";
}

</pre>

<p class="noindent">If you try to process this using the <code>cf-promises</code> command, you will
see something like this:

<pre class="smallexample">     atlas$ ~/LapTop/Cfengine3/trunk/src/cf-promises -r -f ./unit_null_config.cf
     Summarizing promises as text to ./unit_null_config.cf.txt
     Summarizing promises as html to ./unit_null_config.cf.html
</pre>
   <p class="noindent">The &lsquo;<samp><span class="samp">-r</span></samp>&rsquo; option produces a report. Examine the files produced:

<pre class="smallexample">     cat ./unit_null_config.cf.txt
     firefox ./unit_null_config.cf.html
</pre>
   <p>You will see a summary of how cfengine interprets the files, either in
HTML or text. By default, the cfengine components also dump a debugging
file, e.g. <samp><span class="file">promise_output_agent.html</span></samp>, <samp><span class="file">promise_output_agent.txt</span></samp>
with an expanded view.

<!--  -->
<div class="node">
<p><hr>
<a name="Familiiarizing-yourself"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Remote-access-troubleshooting">Remote access troubleshooting</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#The-bare-necessities-of-a-cfengine-3">The bare necessities of a cfengine 3</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Getting-started">Getting started</a>

</div>

<h3 class="section">1.10 Familiarizing yourself</h3>

<p>To familiarize yourself with cfengine 3, type or paste in the following example text:

<pre class="verbatim">########################################################
#
# Simple test execution
#
########################################################

body common control

{
bundlesequence  => { "testbundle"  };
}

########################################################

bundle agent testbundle

{
vars:

  "size" int => "46k";
  "rand" int => randomint("33","$(size)");

commands:

  "/bin/echo" 
     args => "Hello world - $(size)/$(rand)",
     contain => standard,
     classes => cdefine("followup","alert");

  followup::
 
     "/bin/ls" 
       contain => standard;

reports:

  alert::

     "What happened?";

}

######################################################################

body contain standard

{
exec_owner => "mark";
useshell => "true";
}

######################################################################

body classes cdefine(class,alert)

{
promise_repaired => { "$(class)" };
repair_failed => { "$(alert)" };
}
</pre>

   <p>This example shows all of the main features of cfengine: bundles,
bodies, control, variables, and promises.  To the casual eye it might
look complex, but that is because it is explicit about all of the
details. Fortunately it is easy to hide many of these details to
make the example simpler without sacrificing any functionality.

   <p>The first thing to try with this example is to verify it &ndash; did we
make any mistakes? Are there any inconsistencies? To do this we use
the new cfengine program <code>cf-promises</code>. Let's assume that you
typed this into a file called <samp><span class="file">test.cf</span></samp> in the current directory.

<pre class="smallexample">     cf-promises -f ./test.cf
</pre>
   <p>If all is well, typing this command shows no output. Try now running the
command with verbose output.

<pre class="smallexample">     cf-promises -f ./test.cf -v
</pre>
   <p>Now you see a lot of information

<pre class="smallexample">     Reference time set to Sat Aug  2 11:26:06 2008
     
     cf3 Cfengine - 3.0.0
     Free Software Foundation 1994-
     Donated by Mark Burgess, Oslo University College, Norway
     cf3 ------------------------------------------------------------------------
     cf3 Host name is: atlas
     cf3 Operating System Type is linux
     cf3 Operating System Release is 2.6.22.18-0.2-default
     cf3 Architecture = x86_64
     cf3 Using internal soft-class linux for host linux
     cf3 The time is now Sat Aug  2 11:26:06 2008
     cf3 ------------------------------------------------------------------------
     cf3 Additional hard class defined as: 64_bit
     cf3 Additional hard class defined as: linux_2_6_22_18_0_2_default
     cf3 Additional hard class defined as: linux_x86_64
     cf3 Additional hard class defined as: linux_x86_64_2_6_22_18_0_2_default
     cf3 GNU autoconf class from compile time: compiled_on_linux_gnu
     cf3 Interface 1: lo
     cf3 Trying to locate my IPv6 address
     cf3 Looking for environment from cfenvd...
     cf3 Unable to detect environment from cfMonitord
     ---------------------------------------------------------------------
     Loading persistent classes
     ---------------------------------------------------------------------
     
     ---------------------------------------------------------------------
     Loaded persistent memory
     ---------------------------------------------------------------------
     cf3   &gt; Parsing file ./test.cf
     ---------------------------------------------------------------------
     Agent's basic classified context
     ---------------------------------------------------------------------
     
     
     Defined Classes = ( any Saturday Hr11 Min26 Min25_30 Q2 Hr11_Q2 Day2
     August Yr2008 linux atlas 64_bit linux_2_6_22_18_0_2_default x86_64
     linux_x86_64 linux_x86_64_2_6_22_18_0_2_default
     linux_x86_64_2_6_22_18_0_2_default__1_SMP_2008_06_09_13_53_20__0200
     compiled_on_linux_gnu net_iface_lo )
     
     Negated Classes = ( )
     
     Installable classes = ( )
     cf3 Wrote expansion summary to promise_output_common.html
     cf3 Inputs are valid
</pre>
   <p>The last two lines of this are of interest. Each time a component of
cfengine 3 parses a number of promises, it summarizes the information
in an HTML file called generically <code>promise_output_</code><i>component-type</i><code>.html</code>. 
In this case the <code>cf-promises</code> command represents all possible promises,
by the type "common". You can view this output file in a suitable web browser
to see exactly what cfengine has understood by the configuration. 
The non-verbose output of the script when run in the cfengine 3 directory looks something like this:

<pre class="verbatim">host$ ./cf-agent -f ../tests/units/unit_exec_in_sequence.cf
Q ".../bin/echo Hello": Hello world - 46k/219
 -> Last 1 QUOTEed lines were generated by "/bin/echo Hello world - 46k/219"
Q ".../bin/ls": agent.c
Q ".../bin/ls": agentdiagnostic.c
Q ".../bin/ls": agentdiagnostic.o
Q ".../bin/ls": agent.o
Q ".../bin/ls": args.c
Q ".../bin/ls": args.lo
Q ".../bin/ls": args.o
...
Q ".../bin/ls": verify_reports.o
Q ".../bin/ls": verify_storage.c
Q ".../bin/ls": verify_storage.o
 -> Last 288 QUOTEed lines were generated by "/bin/ls"
atlas$
</pre>

<!--  -->
<div class="node">
<p><hr>
<a name="Remote-access-troubleshooting"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Familiiarizing-yourself">Familiiarizing yourself</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Getting-started">Getting started</a>

</div>

<h3 class="section">1.11 Remote access troubleshooting</h3>

<ul class="menu">
<li><a accesskey="1" href="#Server-connection">Server connection</a>
<li><a accesskey="2" href="#Key-exchange">Key exchange</a>
<li><a accesskey="3" href="#Time-windows">Time windows</a>
<li><a accesskey="4" href="#Other-users-than-root">Other users than root</a>
<li><a accesskey="5" href="#Encryption">Encryption</a>
</ul>

<div class="node">
<p><hr>
<a name="Server-connection"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Key-exchange">Key exchange</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Remote-access-troubleshooting">Remote access troubleshooting</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Remote-access-troubleshooting">Remote access troubleshooting</a>

</div>

<h4 class="subsection">1.11.1 Server connection</h4>

<p>When setting up <code>cf-serverd</code>, you might see the error message

<pre class="verbatim">  Unspecified server refusal
</pre>

   <p>This means that <code>cf-serverd</code> is unable or is unwilling to
authenticate the connection from your client machine. The message is
generic: it is deliberately non-specific so that anyone attempting to
attack or exploit the service will not be given information which
might be useful to them. There is a simple checklist for curing this
problem:

     <ol type=1 start=1>
<li>Make sure that the domain variable is set in the configuration files read by both client
and server; alternatively use <code>skipidentify</code> and <code>skipverify</code> to decouple DNS from the
the authentication.

     <li>Make sure that you have granted access to your client in the server body

     <pre class="smallexample">          
          body server control
          {
          allowconnects         =&gt; { "127.0.0.1" , "::1" <var>...etc</var> };
          allowallconnects      =&gt; { "127.0.0.1" , "::1" <var>...etc</var> };
          trustkeysfrom         =&gt; { "127.0.0.1" , "::1" <var>...etc</var> };
          }
          
</pre>
     <li>Make sure you have created valid keys for the hosts using <code>cf-key</code>. 
<li>If you are using secure copy, make sure that you have created a key
file and that you have distributed and installed it to all
participating hosts in your cluster.
        </ol>

<p class="noindent">Always remember that you can run cfengine in verbose or
debugging modes to see how the authentication takes place:

<pre class="verbatim">cf-agent -v 
cf-serverd -v
</pre>

   <p><code>cf-agent</code> reports that access is denied regardless of the nature
of the error, to avoid giving away information which might be used by
an attacker. To find out the real reason for a denial, use verbose &lsquo;<samp><span class="samp">-v</span></samp>&rsquo; or
even debugging mode &lsquo;<samp><span class="samp">-d2</span></samp>&rsquo;.

<div class="node">
<p><hr>
<a name="Key-exchange"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Time-windows">Time windows</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Server-connection">Server connection</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Remote-access-troubleshooting">Remote access troubleshooting</a>

</div>

<h4 class="subsection">1.11.2 Key exchange</h4>

<p>The key exchange model used by cfengine is based on that used by
OpenSSH. It is a peer to peer exchange model, not a central
certificate authority model. This means that there are no scalability
bottlenecks (at least by design, though you might introduce your own
if you go for an overly centralized architecture).

   <p>The problem of key distribution is the conundrum of every public key
infrastructure. Key exchange is handled automatically by cfengine and all you
need to do is to decide which keys to trust.

   <p>When public keys are offered to a server, they could be accepted
automatically on trust because no one is available to make a decision
about them. This would lead to a race to be the first to submit a key
claiming identity.

   <p>Even with DNS checks for correct name/IP address correlation (turned
off with <code>skipverify</code>), it might be possible to submit a false
key to a server.

   <p>The server <code>cf-serverd</code> blocks the acceptance of unknown keys by
default. In order to accept such a new key, the IP address of the
presumed client must be listed in the <code>trustkeysfrom</code> stanza. Once a key
has been accepted, it will never be replaced with a new key, thus no
more trust is offered or required.

   <p>Once you have arranged for the right to connect to the server, you
must decide which hosts will have access to which files. This is done
with <code>access</code> rules.

<pre class="verbatim">
bundle server access_rules()

{
access:

  "/path/file"

    admit   => { "127.0.0.1", "127.0.0.2", "127.0.0.3" },
    deny    => { "192.*" };
}

</pre>

   <p>On the client side, i.e. <code>cf-runagent</code> and <code>cf-agent</code>, there are three issues:

     <ol type=1 start=1>
<li>Choosing which server to connect to. 
<li>Trusting the identity of any previously unknown servers, i.e. trusting
the server's public key to be its and no one else's. (The issues here are
the same as for the server.) 
<li>Choosing whether data transfers should be encrypted (with <code>encrypt</code>).
        </ol>

   <p>Because there are two clients for connecting to <code>cf-serverd</code>
(<code>cf-agent</code> and <code>cf-runagent</code>), there are also two ways on
managing trust of server keys by a client. One is an automated option, setting the option
<code>trustkey</code> in a <code>copy_from</code> stanza, e.g.

<pre class="verbatim">
body copy_from example
     {
     # .. other settings ..
     trustkey => "true";
     }

</pre>

   <p>Another way is to run <code>cf-runagent</code> in interactive mode. When you run <code>cf-runagent</code>, unknown
server keys are offered to you interactively (as with <code>ssh</code>) for you to
accept or deny manually:

<pre class="smallexample">     
     WARNING - You do not have a public key from host ubik.iu.hio.no = 128.39.74.25
               Do you want to accept one on trust? (yes/no)
     --&gt;
     
</pre>
   <div class="node">
<p><hr>
<a name="Time-windows"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Other-users-than-root">Other users than root</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Key-exchange">Key exchange</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Remote-access-troubleshooting">Remote access troubleshooting</a>

</div>

<h4 class="subsection">1.11.3 Time windows (races)</h4>

<p>Once public keys have been exchanged from client to server and from
server to client, the issue of trust is solved according to public key
authentication schemes. You only need to worry about trust when one side
of a connection has never seen the other side before.

   <p>Often you will have a central server and many client satellites. Then
the best way to transfer all the keys is to set the <code>trustkey</code>
flags on server and clients sides to coincide with a time at which you
know that <code>cf-agent</code> will be run, and when a spoofer is unlikely
to be able to interfere.

   <p>This is a once-only task, and the chance of an attacker being able to
spoof a key-transfer is small. It would require skill and
inside-information about the exchange procedure, which would tend to
imply that the trust model was already broken.

   <p>Another approach would be to run <code>cf-runagent</code> against all the hosts
in the group from the central server and accept the keys one by one,
by hand, though there is little to be gained from this.

   <p>Trusting a host for key exchange is unavoidable. There is no clever
way to avoid it. Even transferring the files manually by diskette, and
examining every serial number of the computers you have, the host has
to trust the information you are giving it. It is all based on
assertion. You can make it almost impossible for keys to be faked
or attacked, but you cannot make it absolutely impossible. Security is
about managing reasonable levels of risk, not about magic.

   <p>All security is based on a moment of trust at some point in
time. Cryptographic key methods only remove the need for a repeat of
the trust decision. After the first exchange, trust is no longer needed,
because they keys allow identity to be actually verified.

   <p>Even if you leave the trust options switched on, you are not blindly
trusting the hosts you know about. The only potential insecurity lies
in any new keys that you have not thought about. If you use wildcards
or IP prefixes in the trust rules, then other hosts might be able to
spoof their way in on trust because you have left open a hole for them
to exploit. That is why it is recommended to return the system to the
default state of zero trust immediately after key transfer, by
commenting out the trust options.

   <p>It is possible, though somewhat laborious to transfer the keys out of
band, by copying <samp><span class="file">/var/cfengine/ppkeys/localhost.pub</span></samp> to
<code>/var/cfengine/ppkeys/user-aaa.bbb.ccc.mmm</code> (assuming IPv4) on
another host. e.g.

<pre class="smallexample">     
     localhost.pub -&gt; root-128.39.74.71.pub
     
</pre>
   <p>This would be a silly way to transfer keys between nearby hosts that you
control yourself, but if transferring to long distance, remote hosts
it might be an easier way to manage trust.

<div class="node">
<p><hr>
<a name="Other-users-than-root"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Encryption">Encryption</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Time-windows">Time windows</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Remote-access-troubleshooting">Remote access troubleshooting</a>

</div>

<h4 class="subsection">1.11.4 Other users than root</h4>

<p>Cfengine normally runs as user "root" (except on Windows which does
not normally have a root user), i.e. a privileged administrator. If other users
are to be granted access to the system, they must also generate a key
and go through the same process. In addition, the users must be added
to the server configuration file.

<div class="node">
<p><hr>
<a name="Encryption"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Other-users-than-root">Other users than root</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Remote-access-troubleshooting">Remote access troubleshooting</a>

</div>

<h4 class="subsection">1.11.5 Encryption</h4>

<p>Cfengine provides encryption for keeping file contents private during
transfer. It is assumed that users will use this judiciously. There is
nothing to be gained by encrypting the transfer of public files &ndash;
overt use of encryption just contributes to global warming, burning
unnecessary CPU cycles without offering any security.

   <p>The main role for encryption in configuration management is for
authentication. Cfengine always uses encrypted for authentication, so
none of the encryption settings affect the security of authentication.

<!--  -->
<div class="node">
<p><hr>
<a name="A-simple-crash-course"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#How-to-run-cfengine-3-examples">How to run cfengine 3 examples</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Getting-started">Getting started</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Top">Top</a>

</div>

<h2 class="chapter">2 A simple crash course in concepts</h2>

<ul class="menu">
<li><a accesskey="1" href="#Rules-are-promises">Rules are promises</a>
<li><a accesskey="2" href="#Best-practice-for-writing-promises">Best practice for writing promises</a>
<li><a accesskey="3" href="#Containers">Containers</a>
<li><a accesskey="4" href="#When-and-where-are-promises-made_003f">When and where are promises made?</a>
<li><a accesskey="5" href="#Types-in-cfengine-3">Types in cfengine 3</a>
<li><a accesskey="6" href="#Datatypes-in-cfengine-3">Datatypes in cfengine 3</a>
<li><a accesskey="7" href="#Variable-expansion-in-cfengine-3">Variable expansion in cfengine 3</a>
<li><a accesskey="8" href="#Normal-ordering">Normal ordering</a>
<li><a accesskey="9" href="#Loops-and-lists-in-cfengine-3">Loops and lists in cfengine 3</a>
<li><a href="#Pattern-matching-and-referencing">Pattern matching and referencing</a>
<li><a href="#Distributed-discovery">Distributed discovery</a>
<li><a href="#Developer-structures">Developer structures</a>
</ul>

<div class="node">
<p><hr>
<a name="Rules-are-promises"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Best-practice-for-writing-promises">Best practice for writing promises</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#A-simple-crash-course">A simple crash course</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#A-simple-crash-course">A simple crash course</a>

</div>

<h3 class="section">2.1 Rules are promises</h3>

<p>Everything in cfengine 3 can be interpreted as a promise. Promises can
be made about all kinds of different subjects, from file attributes,
to the execution of commands, to access control decisions and
knowledge relationships.

   <p>This simple but powerful idea allows a very practical uniformity in
cfengine syntax.  There is only one grammatical form for statements in
the language that you need to know and it looks generically like this:

<pre class="smallexample">     
      type:
     
        classes::
     
         "promiser" -&gt; { "promisee1", "promisee2", ... }
     
            attribute_1 =&gt; value_1,
            attribute_2 =&gt; value_2,
            ...
            attribute_n =&gt; value_n;
     
</pre>
   <p class="noindent">We speak of a promiser (the abstract object making the promise), the promisee
is the abstract object to whom the promise is made, and them there is a list
of associations that we call the `body' of the promise, which together with the
promiser-type tells us what it is all about.

   <p>Not all of these elements are necessary every time. Some promises contain a lot
of implicit behaviour. In other cases we might want to be much more explicit. 
For example, the simplest promise looks like this:

<pre class="smallexample">     
     commands:
     
       "/bin/echo hello world";
     
</pre>
   <p class="noindent">This promise has default attributes for everything except the `promiser', i.e. the
command string that promises to execute. 
A more complex promise contains many attributes:

<pre class="smallexample">     
     files:
     
       "/home/mark/tmp/test_plain" -&gt; "system blue team",
     
            comment =&gt; "This comment follows the rule for knowledge integration",
            perms   =&gt; users("@(usernames)"),
            create  =&gt; "true";
     
</pre>
   <p>The list of promisees is not used by cfengine except for documentation, just
as the comment attribute (which can be added to any promise) has no actual function
other than to provide more information to the user in error tracing and auditing.

   <p>You see several kinds of object in this example. All literal strings
(e.g. <code>"true"</code>) in cfengine 3 must be quoted. This provides
absolute consistency and makes type-checking easy and error-correction
powerful. All function-like objects (e.g. <code>users("..")</code>) are either builtin
special functions or parameterized templates which contain the `meat' of the right hand
side.

   <p>The words <code>commands</code>, and <code>files</code> are built-in promise
types. Promise types generally belong each to a particular component
of cfengine, as the components are designed to keep different kinds of
promises.  A few types, such as <code>vars</code>, <code>classes</code> and
<code>reports</code> are common to all the different component bundles. You
will find a full list of the promise types that can be made by the
different components in the `bundles' chapters that follow.

<!--  -->
<div class="node">
<p><hr>
<a name="Best-practice-for-writing-promises"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Containers">Containers</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Rules-are-promises">Rules are promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#A-simple-crash-course">A simple crash course</a>

</div>

<h3 class="section">2.2 Best practice for writing promises</h3>

<p>When writing promises, get into the habit of giving every promise a comment
that explains its intention.

   <p>Also, give related promises <i>handles</i>, or labels that can be used to
refer to them by.

<pre class="verbatim">
files:

  "/var/cfengine/inputs" 

    handle => "update_policy",

    perms => system("600"),
    copy_from => mycopy("$(master_location)","$(policy_server)"),
    depth_search => recurse("inf"),
    file_select => input_files,
    action => immediate;
   
</pre>
If a promise affects another promise is some way, you can make the affected
promise one of the promisees, like this:

<pre class="verbatim">
access:

  "/master/cfengine/inputs" -> { "update_policy", "other_promisee" },

    handle  => "serve_updates",

    admit   => { "217.77.34.*" };

</pre>

   <p>Conversely, if a promise might depend on another in some (even indirect) way, document this too.

<pre class="verbatim">
files:

  "/var/cfengine/inputs" 

    handle     => "update_policy",
    depends_on => "serve_updates",

    perms => system("600"),
    copy_from => mycopy("$(master_location)","$(policy_server)"),
    depth_search => recurse("inf"),
    file_select => input_files,
    action => immediate;


</pre>

   <p>Get into the habit of adding the cause-effect lines of influence. 
Enterprise editions of cfengine will track the dependencies between these
promises and map out impact analyses.

<!--  -->
<div class="node">
<p><hr>
<a name="Containers"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#When-and-where-are-promises-made_003f">When and where are promises made?</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Best-practice-for-writing-promises">Best practice for writing promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#A-simple-crash-course">A simple crash course</a>

</div>

<h3 class="section">2.3 Containers</h3>

<p>Cfengine allows you to group multiple promise statements
    into containers called bundles.
<pre class="smallexample">     
     bundle agent identifier
     
     {
     commands:
     
       "/bin/echo These commands are a silly way to use cfengine";
       "/bin/ls -l";
       "/bin/echo But they illustrate a point";
     
     }
     
</pre>
   <p>Bundles serve two purposes: they allow us to collect related promises under a
single heading, like a subroutine, and they allow us to mix configuration for different
parts of cfengine in the same file. The type of a bundle is the name of the component
of cfengine for which it is intended.

   <p>For instance, we can make a self-contained example agent-server
configuration by labelling the bundles:

<pre class="smallexample">     
     #
     # Not a complete example
     #
     
     bundle agent testbundle
     
     {
     files:
     
       "/home/mark/tmp/testcopy"
     
         copy_from    =&gt; mycopy("/home/mark/LapTop/words","127.0.0.1"),
         perms        =&gt; system,
         depth_search =&gt; recurse("inf");
     
     }
     
     #
     
     bundle server access_rules
     
     {
     access:
     
       "/home/mark/LapTop"
     
         admit   =&gt; { "127.0.0.1" };
     }
     
</pre>
   <p>Another type of container in cfengine 3 is a `body' part. Body parts
exist to hide complex parameter information in reusable containers. 
The right hand side of some attribute assignments use body containers
to reduce the amount of in-line information and preserve readability. 
You cannot choose where to use bodies: either they are used or they
are not used for a particular kind of attribute. What you can choose, however, is
the name and number of parameters for the body; and you can make as many of them as you like:
For example:

<pre class="smallexample">     
     body copy_from mycopy(from,server)
     
     {
     source      =&gt; "$(from)";
     servers     =&gt; { "$(server)" };
     copy_backup =&gt; "true";
     
     special_class::
     
       purge       =&gt; "true";
     }
     
</pre>
   <p>Notice also that classes can be used in bodies as well as parameters so that
you can hide environmental adaptations in these bodies also. The classes used
here are effectively ANDed with the classes under which the calling promise
is defined.

<!--  -->
<div class="node">
<p><hr>
<a name="When-and-where-are-promises-made%3f"></a>
<a name="When-and-where-are-promises-made_003f"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Types-in-cfengine-3">Types in cfengine 3</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Containers">Containers</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#A-simple-crash-course">A simple crash course</a>

</div>

<h3 class="section">2.4 When and where are promises made?</h3>

<p>When you type a promise into a cfengine bundle, the promise will be
read by every cf-agent that reads the file, each time it is
called into being. For some promises this is okay, but for others
you only want to verify the promise once in a while, e.g. once per day
or once per hour. There are two ways to say when and where a promise
applies in cfengine:

     <dl>
<dt><i>Classes</i><dd>Classes are the double-colon decision syntax in cfengine. They
determine in what context a promise is made, i.e. when and
where. Recall the basic syntax of a promise:
     <pre class="smallexample">          
           <var>promise-type</var>:
          
              <var>class-expression</var>::
          
                 <var>promiser</var> -&gt; <var>promisee</var>
          
                    <var>attribute</var> =&gt; <var>body</var>,
                         ifvarclass =&gt; <var>other-class-expression</var>;
          
</pre>
     <p>The class expression may contain words like &lsquo;<samp><span class="samp">Hr12</span></samp>&rsquo;, meaning
from 12:00 p.m - 13:00 p.m., or &lsquo;<samp><span class="samp">Hr12&amp;Min05_10</span></samp>&rsquo;, meaning
between 12:05 and 12:10. Classes may also have spatial descriptors
like &lsquo;<samp><span class="samp">myhost</span></samp>&rsquo; or &lsquo;<samp><span class="samp">solaris</span></samp>&rsquo;, which decide which hosts
in the namespace, or &lsquo;<samp><span class="samp">ipv4_192_168_1_101</span></samp>&rsquo; which decides the location
in IPv4 address space.

     <p>If the class expression is true, the promise can be considered made
for the duration of the current execution.

     <p>Cfengine 3 has a new class predicate <code>ifvarclass</code> which is
ANDed with the normal class expression, and which is evaluated
together with the promise. It may contain variables as long as the
resulting expansion is a legal class expression. 
<a name="index-ifvarclass-1"></a>
<br><dt><i>Locks</i><dd>Locks determine how often a promise is verified. 
</dl>

   <p>Cfengine is controlled by a series of locks which prevent it from
checking promises too often, and which prevent it from spending too
long trying to verify promises it already verified recently. The locks
work in such a way that you can start several cfengine processes
simultaneously without them interfering with each other. You can
control two things about each kind of action in the action sequence:

     <dl>
<dt>&lsquo;<samp><span class="samp">ifelapsed</span></samp>&rsquo;<dd>The minimum time which should have passed since the last time
that promise was verified. It will not be executed again until
this amount of time has elapsed. 
(Default time is 1 minute.)

     <br><dt>&lsquo;<samp><span class="samp">expireafter</span></samp>&rsquo;<dd>The maximum amount of time cf-agent should wait for an old
instantiation to finish before killing it
and starting again. (Default time is 120 minutes.)

   </dl>

<p class="noindent">You can set these values either globally (for all
actions) or for each action separately. If you
set global and local values, the local values override
the global ones. All times are written in units
of <em>minutes</em>. Global setting is in the control body:

<pre class="verbatim">
body agent control
{
ifelapsed => "60";
}

</pre>

<p class="noindent">or locally in the transaction bodies:

<pre class="verbatim">
body action example
{
ifelapsed => "60";
}

</pre>

   <p>These locks do not prevent the whole of cf-agent from running, only
atomic promise checks. Several different atoms can be run concurrently
by different cf-agents.  The locks ensure that atoms will never be
started by two cf-agents at the same time, or too soon after a
verification, causing contention and wasting CPU cycles.

<!--  -->
<div class="node">
<p><hr>
<a name="Types-in-cfengine-3"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Datatypes-in-cfengine-3">Datatypes in cfengine 3</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#When-and-where-are-promises-made_003f">When and where are promises made?</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#A-simple-crash-course">A simple crash course</a>

</div>

<h3 class="section">2.5 Types in cfengine 3</h3>

<p>A key difference in cfengine 3 compared to earlier versions is the
presence of data types. Data types are a mechanism for associating
values and checking consistency in a language. Once again, there is a
simple pattern to types in cfengine.

   <p>The principle is very simple: types exist in order to match like a
plug-socket relationship. In the examples above, you can see two places
where types are used to match templates:

     <ul>
<li>Matching bundles to components:
     <pre class="smallexample">          
          bundle TYPE name  # matches TYPE to running agent
          {
          }
          
</pre>
     <li>Match bodies templates to lvalues in <code>lvalues =&gt; rvalue</code> constraints:

     <pre class="smallexample">          
          body TYPE name    # matches TYPE =&gt; name in promise
          {
          }
          
</pre>
     </ul>

   <p>Check these by identifying the words &lsquo;<samp><span class="samp">agent</span></samp>&rsquo; and &lsquo;<samp><span class="samp">copy_from</span></samp>&rsquo;
in the examples above. Types are there to make configuration more robust.

<!--  -->
<div class="node">
<p><hr>
<a name="Datatypes-in-cfengine-3"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-expansion-in-cfengine-3">Variable expansion in cfengine 3</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Types-in-cfengine-3">Types in cfengine 3</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#A-simple-crash-course">A simple crash course</a>

</div>

<h3 class="section">2.6 Datatypes in cfengine 3</h3>

<p>Cfengine variables have two meta-types: scalars and lists. A scalar is a single value,
a list is a collection of scalars. Each scalar may have one of three types:
<code>string</code>, <code>int</code> or <code>real</code>. Typing is dynamic, so these are
interchangable in many instances. However arguments to special functions check legal
type for consistency.

   <p>Integer constants may use suffixes to represent large numbers.

     <ul>
  <li>'k'
          times 1000.

     <li>'K':
          times 1024.

     <li>'m':
          times 1000^2
  <li>'M':
          times 1024^2
  <li>'g':
          times 1000^3
  <li>'G':
          times 1024^3

     <li>'%'
    meaning percent, in limtied contexts

     <li>inf
A constant representing an unlimited value. 
</ul>

<!--  -->
<div class="node">
<p><hr>
<a name="Variable-expansion-in-cfengine-3"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Normal-ordering">Normal ordering</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Datatypes-in-cfengine-3">Datatypes in cfengine 3</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#A-simple-crash-course">A simple crash course</a>

</div>

<h3 class="section">2.7 Variable expansion in cfengine 3</h3>

<p>Cfengine 3 has some simple rules for variable expansion. These make
a couple of restrictions that enforce discipline of clarity and
allow automatic dependency tracking in enterprise versions of cfengine.

<ul class="menu">
<li><a accesskey="1" href="#Scalar-variable-expansion">Scalar variable expansion</a>
<li><a accesskey="2" href="#List-variable-substitution-and-expansion">List variable substitution and expansion</a>
<li><a accesskey="3" href="#Arrays-in-cfengine-3">Arrays in cfengine 3</a>
</ul>

<div class="node">
<p><hr>
<a name="Scalar-variable-expansion"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#List-variable-substitution-and-expansion">List variable substitution and expansion</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-expansion-in-cfengine-3">Variable expansion in cfengine 3</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-expansion-in-cfengine-3">Variable expansion in cfengine 3</a>

</div>

<h4 class="subsection">2.7.1 Scalar variable expansion</h4>

<p>Scalar variables are written &lsquo;<samp><span class="samp">$(name)</span></samp>&rsquo; and they represent
a single value at a time.

     <ul>
<li>Scalars that are written without a context, e.g. &lsquo;<samp><span class="samp">$(myvar)</span></samp>&rsquo;
are local to the current bundle.

     <li>Scalars are globally available everywhere provided one
uses the context to verify them e.g. &lsquo;<samp><span class="samp">$(context.myvar)</span></samp>&rsquo;
may be written to access the variable `myvar' in bundle `context'.

   </ul>

<!--  -->
<div class="node">
<p><hr>
<a name="List-variable-substitution-and-expansion"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Arrays-in-cfengine-3">Arrays in cfengine 3</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Scalar-variable-expansion">Scalar variable expansion</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-expansion-in-cfengine-3">Variable expansion in cfengine 3</a>

</div>

<h4 class="subsection">2.7.2 List variable substitution and expansion</h4>

     <ul>
<li>Scalar references to <i>local</i> list variables imply iteration, e.g. 
suppose we have local list variable &lsquo;<samp><span class="samp">@(list)</span></samp>&rsquo;, then the
scalar &lsquo;<samp><span class="samp">$(list)</span></samp>&rsquo; implies an iteration over every value of the
list.

     <li>Lists can be passed around in their entirety in any context
where a list is expected as &lsquo;<samp><span class="samp">@(list)</span></samp>&rsquo;., e.g.

     <pre class="verbatim">     
      vars:
     
        "longlist" slist => { @(shortlist), "plus", "plus" };
       
        "shortlist" slist => { "you", "me" }; 
     
</pre>

     <li>Only local lists can be expanded directly. Thus &lsquo;<samp><span class="samp">$(list)</span></samp>&rsquo;
can be expanded but not &lsquo;<samp><span class="samp">$(context.list)</span></samp>&rsquo;. See below for the
explanation.

</ul>

   <p>During list expansion, only local lists can be expanded, thus global
list references have to be mapped into a local context if you want to
use them for iteration. Instead of doing this in some
arbitrary way, with possibility of name collisions, cfengine
asks you to make this explicit. There are two possible approaches.

   <p>The first uses parameterization to map a global list into a local
context.
<pre class="verbatim">
#
# Show access of external lists.
#
# - to pass lists globally, use a parameter to dereference them
#

body common control
{
bundlesequence => { hardening(@(va.tmpdirs)) };
}

#########################################################

bundle common va 
{
vars:
 
 "tmpdirs"  slist => { "/tmp", "/var/tmp", "/usr/tmp"  };

} 

##########################################################

bundle agent hardening(x)
{
classes:

  "ok" expression => "any";

vars:

 "other"    slist => { "/tmp", "/var/tmp" };

reports:

  ok::

    "Do $(x)";
    "Other: $(other)";
} 

</pre>

   <p>This alternative uses a direct `short-circuit' approach to map the global
list into the local context.

<pre class="verbatim">#
# Show access of external lists.
#

body common control
{
bundlesequence => { hardening };
}

#########################################################

bundle common va 
{
vars:
 
 "tmpdirs"  slist => { "/tmp", "/var/tmp", "/usr/tmp"  };

} 

##########################################################

bundle agent hardening
{
classes:

  "ok" expression => "any";

vars:

 "other"    slist => { "/tmp", "/var/tmp" };
 "x"        slist => { @(va.tmpdirs) };

reports:

  ok::

    "Do $(x)";
    "Other: $(other)";
} 
</pre>

<!--  -->
<div class="node">
<p><hr>
<a name="Arrays-in-cfengine-3"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#List-variable-substitution-and-expansion">List variable substitution and expansion</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-expansion-in-cfengine-3">Variable expansion in cfengine 3</a>

</div>

<h4 class="subsection">2.7.3 Arrays in cfengine 3</h4>

<p>Arrays variables are written with &lsquo;<samp><span class="samp">[</span></samp>&rsquo; and &lsquo;<samp><span class="samp">]</span></samp>&rsquo; brackets, e.g.

<pre class="verbatim">
bundle agent example

{
vars:

  "component" slist => { "cf-monitord", "cf-serverd", "cf-execd" };

  "array[cf-monitord]" string => "The monitor";
  "array[cf-serverd]" string => "The server";
  "array[cf-execd]" string => "The executor, not executionist";

commands:

   "/bin/echo $(component) is"

            args => "$(array[$(component)])";

}

</pre>

   <p>Arrays are associative and may be of type scalar or list. Enumerated
arrays are simply treated as a special case of associative arrays, since
there are no numerical loops in cfengine. Special functions exist to
extract lists of keys from array variables for iteration purposes.

   <p>Thus one could have written the example above in the form of the
following example:

<pre class="verbatim">
bundle agent array

{
vars:

  "v[index_1]" string => "value_1";
  "v[index_2]" string => "value_2";

  "parameter_name" slist => getindices("v");

reports:

  Yr2008::

   "Found index: $(parameter_name)";

}

</pre>

<!--  -->
<div class="node">
<p><hr>
<a name="Normal-ordering"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Loops-and-lists-in-cfengine-3">Loops and lists in cfengine 3</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-expansion-in-cfengine-3">Variable expansion in cfengine 3</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#A-simple-crash-course">A simple crash course</a>

</div>

<h3 class="section">2.8 Normal ordering</h3>

<p>Ordering of promise verification within cfengine takes a pragmatic approach. 
In the absence of dependencies (independent) promises can be checked in any
order. However, one can encode both implicit and explicit ordering dependency.

   <p>Cfengine takes a pragmatic point of view to ordering, since certain
data structures require ordering to be preserved, e.g. editing in
files. The rules are as follows:

     <ol type=1 start=1>
<li>Cfengine executes promise bundles in the strict order defined by
the <code>bundlesequence</code>. 
<li>Within a bundle, the promise types are executed in a round-robin
fashion according to so-called `normal ordering' (essentially deletion
first followed by creation). The actual sequence continues for up to three
iterations of the following:
<pre class="verbatim">     
        vars
        classes
        interfaces
        processes
        storage
        packages
        commands
        methods
        files
        reports
     
</pre>
Within line_editing bundles, the normal ordering is:
<pre class="verbatim">        vars
        classes
        delete_lines
        field_edits
        insert_lines
        replace_patterns
        reports
</pre>

     <li>The order of promises within one of the above types follows their
top-down ordering within the bundle itself.

     <li>The order may be overridden by making a promise depend on a class
that is set by another promise.

        </ol>

<!--  -->
<div class="node">
<p><hr>
<a name="Loops-and-lists-in-cfengine-3"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Pattern-matching-and-referencing">Pattern matching and referencing</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Normal-ordering">Normal ordering</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#A-simple-crash-course">A simple crash course</a>

</div>

<h3 class="section">2.9 Loops and lists in cfengine 3</h3>

<p>There are no explicit loops in cfengine, instead there are lists. 
To make a loop, you simply refer to a list as a scalar and cfengine
will assume a loop over all items in the list.

   <p>For example, in the excepts below the list <code>component</code> has three
elements. The list as a whole may be referred to as
<code>@(component)</code>, in order to pass the whole list to a promise
where a list is expected. However, if we write <code>$(component)</code>,
i.e. the scalar variable, then cfengine assumes that it should substitute
each scalar from the list in turn, and thus iterate over the list
elements using a loop.

<pre class="verbatim">
body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
vars:

  "component" slist => { "cf-monitord", "cf-serverd", "cf-execd" };

  "new_list" slist => { "cf-know", @(component) };

processes:

  "$(component)" restart_class => canonify("start_$(component)");

commands:

   "/bin/echo /var/cfengine/bin/$(component)"

       ifvarclass => canonify("start_$(component)");
}

</pre>

   <p>If a variable is repeated, its value is tied throughout
the expression; so the output of:

<pre class="verbatim">
body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
vars:

  "component" slist => { "cf-monitord", "cf-serverd", "cf-execd" };

  "array[cf-monitord]" string => "The monitor";
  "array[cf-serverd]" string => "The server";
  "array[cf-execd]" string => "The executor, not executionist";

commands:

   "/bin/echo $(component) is"

            args => "$(array[$(component)])";
}

</pre>

<p class="noindent">is as follows:

<pre class="verbatim">
Q ".../bin/echo cf-mo": cf-monitord is The monitor
 -> Last 1 QUOTEed lines were generated by "/bin/echo cf-monitord is The monitor"
Q ".../bin/echo cf-se": cf-serverd is The server
 -> Last 1 QUOTEed lines were generated by "/bin/echo cf-serverd is The server"
Q ".../bin/echo cf-ex": cf-execd is The executor, not executionist
 -> Last 1 QUOTEed lines were generated by "/bin/echo cf-execd is The executor, not executionist"

</pre>

<!--  -->
<div class="node">
<p><hr>
<a name="Pattern-matching-and-referencing"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Distributed-discovery">Distributed discovery</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Loops-and-lists-in-cfengine-3">Loops and lists in cfengine 3</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#A-simple-crash-course">A simple crash course</a>

</div>

<h3 class="section">2.10 Pattern matching and referencing</h3>

<p>One of the strengths of cfengine 3 is the ability to recognize and
exploit patterns.  All string patterns in cfengine 3 are matched using
regular expressions. The preferred regular expression library is the
Perl Compatible Regular Expression library. This is more powerful and
more reliable than the default POSIX regular expression code and all
users should make the PCRE library available during compilation if
possible.

   <p>Cfengine has the ability to extract back-references from pattern matches. 
This makes sense in two cases. Back references are fragments of a string
that match parenethetic expressions. For instance, suppose we have the string:

<pre class="smallexample">     
      Mary had a little lamb ...
     
</pre>
   <p class="noindent">and apply the regular expression

<pre class="smallexample">     
      "Mary ([^l]+)little (.*)"
     
</pre>
   <p>The pattern matches the entire string, and it
contains two parentheses, which respectively match
the fragments `has a ' and `lamb ...'. The regular
expression libraries assign three matches to this
result, labelled 0, 1 and 2.

   <p>The zeroth value is the entire string matched by the
total expression. The first value is the fragment matched
by the first parenthesis, and so on.

   <p>Each time cfengine matches a string, these values are
assigned to a special variable context <code>$(match.</code><var>n</var><code>)</code>. 
The fragments can be referred to in the remainder of the promise. 
There are two places where this makes sense. One is in pattern replacement
during file editing, and the other is in searching for files.

   <p>Consider the examples below:
<pre class="verbatim">
bundle agent testbundle

{
files:

  # The back reference in a path only applies to the last link
  # of the pathname, so the (tmp) gets ignored

  "/home/mark/(tmp)/(cf3)_(.*)"
       create    => "true",
       edit_line => myedit("second $(match.2)");


  # but ...

  "/home/mark/(tmp)/cf3_test"
       create    => "true",
       edit_line => myedit("second $(match.1)");


}

</pre>
If there were to exist a file <samp><span class="file">/home/mark/tmp/cf3_test</span></samp>,
then we would have:

     <dl>
<dt>&lsquo;<samp><span class="samp">$(match.0)</span></samp>&rsquo;<dd>equal to `/home/mark/tmp/cf3_test'
<br><dt>&lsquo;<samp><span class="samp">$(match.1)</span></samp>&rsquo;<dd>equal to `tmp'
<br><dt>&lsquo;<samp><span class="samp">$(match.2)</span></samp>&rsquo;<dd>equal to `cf3'
<br><dt>&lsquo;<samp><span class="samp">$(match.3)</span></samp>&rsquo;<dd>equal to `test'
</dl>

   <p>Now look at the edit bundle. This uses back references to
replace shell comment lines with C comment lines. (The same
approach is used to hash-comment lines in files).

<pre class="verbatim">
bundle edit_line myedit(parameter)
  {
  vars:

   "edit_variable" string => "private edit variable is $(parameter)"; 

  insert_lines:

     "$(edit_variable)";
  
  replace_patterns:

  # replace shell comments with C comments

   "#(.*)"

      replace_with => C_comment,
     select_region => MySection("New section");

  }

########################################
# Bodies
########################################

body replace_with C_comment

{
replace_value => "/* $(match.1) */"; # backreference 0
occurrences => "all";  # first, last all
}

########################################################

body select_region MySection(x)

{
select_start => "\[$(x)\]";
select_end => "\[.*\]";
}

</pre>

   <p>Try this example on the file
<pre class="verbatim">[First section]

one
two 
three

[New section]

four
#five
six

[final]

seven
eleven
</pre>

<p class="noindent">The resulting file is edited like this:
<pre class="verbatim">[First section]

one
two
three

[New section]

four
/* cf3 */
six

[final]

seven
eleven

private edit variable is second test
</pre>

<ul class="menu">
<li><a accesskey="1" href="#Runaway-change-warning">Runaway change warning</a>
<li><a accesskey="2" href="#Commenting-lines">Commenting lines</a>
</ul>

<div class="node">
<p><hr>
<a name="Runaway-change-warning"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Commenting-lines">Commenting lines</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Pattern-matching-and-referencing">Pattern matching and referencing</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Pattern-matching-and-referencing">Pattern matching and referencing</a>

</div>

<h4 class="subsection">2.10.1 Runaway change warning</h4>

<p>Be careful when using patterns to search for files that are altered by cfengine
is you are not using a file repository. Each time cfengine makes a change it
saves an old file into a copy like <samp><span class="file">cf3_test.cf-before-edit</span></samp>. These
new files then get matched by the same expression above &ndash; because it ends
in the generic<code>.*</code>), or does not
specify a tail for the expression. Thus cfengine will happily edit backups
of the edit file too, and generate a recursive process, resulting in something
like the following:

<pre class="smallexample">     cf3_test                  cf3_test.cf-before-edit
     cf3_test~                 cf3_test~.cf-before-edit.cf-before-edit
     cf3_test~.cf-before-edit  cf3_test~.cf-before-edit.cf-before-edit.cf-before-edit
</pre>
   <p>Always try to be as specific as possible when specifying patterns. A lazy approach
will often come back to haunt you.

<div class="node">
<p><hr>
<a name="Commenting-lines"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Runaway-change-warning">Runaway change warning</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Pattern-matching-and-referencing">Pattern matching and referencing</a>

</div>

<h4 class="subsection">2.10.2 Commenting lines</h4>

<p>The following example shows how you would hash-comment lines in a file
using cfengine 3.

<pre class="verbatim">######################################################################
#
# HashCommentLines implemented in cfengine 3
#
######################################################################

body common control

{
version => "1.2.3";
bundlesequence  => { "testbundle"  };
}

########################################################

bundle agent testbundle

{
files:

  "/home/mark/tmp/comment_test"

       create    => "true",
       edit_line => comment_lines_matching;
}

########################################################

bundle edit_line comment_lines_matching
  {
  vars:

    "regexes" slist => { "one.*", "two.*", "four.*" };

  replace_patterns:

   "^($(regexes))$"
      replace_with => comment("# ");
  }

########################################
# Bodies
########################################

body replace_with comment(c)

{
replace_value => "$(c) $(match.1)";
occurrences => "all";
}

</pre>

<!--  -->
<div class="node">
<p><hr>
<a name="Distributed-discovery"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Developer-structures">Developer structures</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Pattern-matching-and-referencing">Pattern matching and referencing</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#A-simple-crash-course">A simple crash course</a>

</div>

<h3 class="section">2.11 Distributed discovery</h3>

<p>Cfengine's philosophy and modus operandi is to make machines as self-reliant
as possible. This is the path to scalability. Sometimes we want machines
to be able to detect one another and sample each others' behaviour. This can
be accomplished using probes and server functions.

   <p>For example, testing whether services are up and running can be a useful
probe even from a local host. Cfengine has in-built functions for generically
probing the environment; these are designed to encourage decentralized
monitoring.

<pre class="verbatim">
body common control

{
bundlesequence  => { "test"  };
}

###########################################################

bundle agent test

{     
vars:

 "hosts" slist => { "server1.example.org", "server2", "server3" };
 
 "up_servers" int =>  selectservers("@(hosts)","80","","","100","alive_servers");

classes:

  "someone_alive" expression => isgreaterthan("$(up_servers)","0");

  "i_am_a_server" expression => regarray("up_servers","$(host)|$(fqhost)");

reports:

  someone_alive::

    "Number of active servers $(up_servers)" action => always;

    "First server $(alive_servers[0]) fails over to $(alive_servers[1])";


}

</pre>

<!--  -->
<div class="node">
<p><hr>
<a name="Developer-structures"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Distributed-discovery">Distributed discovery</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#A-simple-crash-course">A simple crash course</a>

</div>

<h3 class="section">2.12 Developer structures</h3>

<p>Developers may note that the internal data-types follow a simple set
of internal linked lists, as in the diagram below.

   <div class="block-image"><img src="list_expand.png" alt="The type relationships in list expansion"></div>

<!--  -->
<div class="node">
<p><hr>
<a name="How-to-run-cfengine-3-examples"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#A-complete-configuration">A complete configuration</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#A-simple-crash-course">A simple crash course</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Top">Top</a>

</div>

<h2 class="chapter">3 How to run cfengine 3 examples</h2>

<p>The cfengine <samp><span class="file">tests</span></samp> directory contains a multitude of examples of cfengine 3 code. 
These instructions assume that you have all of your configuration in a
single test file, such as the example in the distribution directory
<samp><span class="file">tests/units</span></samp>.

     <ol type=1 start=1>
<li>Test the file as a non-privileged user first, if you can.

     <li>Always verify syntax first with <code>cf-promises</code>. This requires no privileges. 
An <code>cf-agent</code> will not execute a configuration that has not passed this test.

     <pre class="smallexample">          
          host$ cf-promises -f ./inputfile.cf
          
</pre>
     <li>Run the examples like this, e.g.

     <pre class="smallexample">          
          host$ src/cf-promises -f ./tests/units/unit_server_copy_localhost.cf
          host$ src/cf-serverd -f ./tests/units/unit_server_copy_localhost.cf
          host$ src/cf-agent -f ./tests/units/unit_server_copy_localhost.cf
          
</pre>
        </ol>

   <p>Running <code>cf-agent</code> in verbose mode provides detailed information
about the state of the systems promises.

<pre class="smallexample">     Outcome of version 1.2.3: Promises observed to be kept 99%,
     Promises repaired 1%, Promises not repaired 0%
</pre>
   <p>The log-file <samp><span class="file">WORKDIR/promise.log</span></samp> contains the summary of these reports
with timestamps. This is the simplest kind of high level audit record of the
system.

<!--  -->
<div class="node">
<p><hr>
<a name="A-complete-configuration"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Control-Promises">Control Promises</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#How-to-run-cfengine-3-examples">How to run cfengine 3 examples</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Top">Top</a>

</div>

<h2 class="chapter">4 A complete configuration</h2>

<p>To illustrate a complete configuration for agents and daemons,
consider the following example code, supplied in the <samp><span class="file">inputs/</span></samp>
directory of the distribution. Comments indicate the thinking behind
this starting point.

<ul class="menu">
<li><a accesskey="1" href="#promises_002ecf">promises.cf</a>
<li><a accesskey="2" href="#site_002ecf">site.cf</a>
<li><a accesskey="3" href="#update_002ecf">update.cf</a>
<li><a accesskey="4" href="#failsafe_002ecf">failsafe.cf</a>
<li><a accesskey="5" href="#What-should-a-failsafe-or-update-file-contain">What should a failsafe or update file contain</a>
<li><a accesskey="6" href="#Recovery-from-errors-in-the-configuration">Recovery from errors in the configuration</a>
<li><a accesskey="7" href="#Recovery-from-errors-in-the-software">Recovery from errors in the software</a>
</ul>

<div class="node">
<p><hr>
<a name="promises.cf"></a>
<a name="promises_002ecf"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#site_002ecf">site.cf</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#A-complete-configuration">A complete configuration</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#A-complete-configuration">A complete configuration</a>

</div>

<h3 class="section">4.1 <samp><span class="file">promises.cf</span></samp></h3>

<p>This file is the first file that <code>cf-agent</code> with no arguments
will try to look for. It should contain all of the basic
configuration settings, including a list of other files
to include. It should have a <code>bundlesequence</code>.

   <p>This file can stay fixed, except for extending the bundlesequence. 
The bundlesequence acts like the `genetic makeup' of the configuration. 
In a large configuration, you will want to have a different bundlesequence
for different classes of host. Use list variables to paste in
list fragments to describe the make-up of each class.

<pre class="verbatim">#######################################################
#
# promises.cf
#
#######################################################

body common control

{
# List the `genes' for this system..

bundlesequence  => { 
                   "update",
                   "garbage_collection",
                   "main",
                   "cfengine"  
                   };


inputs          => {
                   "update.cf",
                   "site.cf",
                   "library.cf" 
                   };
}

#######################################################
# Now set defaults for all components' hard-promises
#######################################################

body agent control
{
# if default runtime is 5 mins we need this for long jobs
ifelapsed => "15";
}

#######################################################

body monitor control
{
forgetrate => "0.7";
histograms => "true";
}

#######################################################

body executor control

{
splaytime => "1";
mailto => "cfengine_mail@example.org";
smtpserver => "localhost";
mailmaxlines => "30";

# Instead of a separate update script, now do this

exec_command => "$(sys.workdir)/bin/cf-agent -f failsafe.cf &amp;&amp; $(sys.workdir)/bin/cf-agent";
}

#######################################################

body reporter control

{
reports => { "performance", "last_seen", "monitor_history" };
build_directory => "/tmp/nerves";
report_output => "html";
}

#######################################################

body runagent control
{
hosts => { 
          "127.0.0.1" 
          # , "myhost.example.com:5308", ...
         };

}

#######################################################

body server control 

{
allowconnects         => { "127.0.0.1" , "::1" };
allowallconnects      => { "127.0.0.1" , "::1" };
trustkeysfrom         => { "127.0.0.1" , "::1" };

# Make updates and runs happen in one

cfruncommand => 

 "$(sys.workdir)/bin/cf-agent -f failsafe.cf &amp;&amp; $(sys.workdir)/bin/cf-agent";

allowusers   => { "root" };
}

</pre>

<div class="node">
<p><hr>
<a name="site.cf"></a>
<a name="site_002ecf"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#update_002ecf">update.cf</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#promises_002ecf">promises.cf</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#A-complete-configuration">A complete configuration</a>

</div>

<h3 class="section">4.2 <samp><span class="file">site.cf</span></samp></h3>

<p>Use this file to add your site-specific configuration. 
Common bundles can be used to define global variables. 
Otherwise, unqualified variables are local to the bundle in which
they are defined &ndash; however they can be access by
writing <code>$(bundle.variable)</code>.

<pre class="verbatim">#######################################################
#
# site.cf
#
#######################################################

bundle common g
{
vars:

  SuSE::

   "crontab" string => "/var/spool/cron/tabs/root";

 !SuSE::

   "crontab" string => "/var/spool/cron/crontabs/root";
}

</pre>

   <p>The cfengine bundle below detects whether cfengine 2 is already
running on the host or not, and if so attempts to kill off old daemon
processes and encapsulate the agent. It also looks for rules in the
old cfengine configuration that would potentially spoil cfengine 3's
control of the system: the last thing we want is for cfengine 2 and
cfengine 3 to fight each other for control of the system.  Cfengine 3
tries to edit an existing crontab entry to replace any references to
<code>cfexecd</code> with <code>cf-execd</code>; if none are found it will add a 5
minute run schedule.  You should never put <code>cf-agent</code>or
<code>cf-agent</code> directly inside <code>cron</code> without the <code>cf-execd</code>
wrapper.

<pre class="verbatim">#######################################################
# Start with cfengine itself
#######################################################

bundle agent cfengine

{
classes:

  "integrate_cfengine2" 

      and => { 
             fileexists("$(sys.workdir)/inputs/cfagent.conf"), 
             fileexists("$(sys.workdir)/bin/cfagent")
             };

vars:

   "cf2bits" slist => { "cfenvd", "cfservd", "cfexecd" };

commands:

 integrate_cfengine2:: 

   "$(sys.workdir)/bin/cfagent"

        action => longjob;

files:

  # Warn about rules relating to cfengine 2 in inputs - could conflict

  "$(sys.workdir)/inputs/.*"

       comment     => "Check if there are still promises about cfengine 2 that need removing",
       edit_line   => DeleteLinesMatching(".*$(cf2bits).*"),
       file_select => OldCf2Files,
       action      => WarnOnly;

  # Check cf-execd and schedule is in crontab

  "$(g.crontab)"
       edit_line => upgrade_cfexecd,
         classes => define("exec_fix");

processes:

  exec_fix::

    "cron" signals => { "hup" };


}

#######################################################
# General site issues can be in bundles like this one
#######################################################

bundle agent main

{
vars:

  "component" slist => { "cf-monitord", "cf-serverd" };

 # - - - - - - - - - - - - - - - - - - - - - - - -

files:

  "$(sys.resolv)"  # test on "/tmp/resolv.conf" #

     create        => "true",
     edit_line     => resolver,
     edit_defaults => def;

 # Uncomment this to perform a change-detection scan

 #  "/usr"         
 #     changes      => lay_trip_wire,
 #     depth_search => recurse("inf"),
 #     action       => measure;

processes:

  "cfenvd"             signals => { "term" };

 # Uncomment this when you are ready to upgrade the server
 #
 #  "cfservd"             signals => { "term" };
 #

 # Now make sure the new parts are running, cf-serverd will fail if
 # the old server is still running 

  "$(component)" restart_class => canonify("start_$(component)");

 # - - - - - - - - - - - - - - - - - - - - - - - -

commands:

   "$(sys.workdir)/bin/$(component)"

       ifvarclass => canonify("start_$(component)");

}

</pre>

   <p>This section takes a backup of a user home directory.  This is
especially useful for a single laptop or personal workstation that
does not have a regular external backup. If a user deletes a file by
accident, this shadow backup might contain the file even while
travelling offline.

<pre class="verbatim">
#######################################################
# Backup
#######################################################

bundle agent backup
{
files:

  "/home/backup"

     copy_from => cp("/home/mark"),
  depth_search => recurse("inf"),
   file_select => exclude_files,
        action => longjob;

}

#######################################################
# Garbage collection issues
#######################################################

bundle agent garbage_collection
{
files:

  "$(sys.workdir)/outputs" 

    delete => tidy,
    file_select => days_old("3"),
    depth_search => recurse("inf");


}

###########################################################

body file_select OldCf2Files
{
leaf_name => { 
             "promises.cf", 
             "site.cf", 
             "library.cf", 
             "failsafe.cf", 
             ".*.txt", 
             ".*.html", 
             ".*~",
             "#.*" 
             };

file_result => "!leaf_name";
}

###########################################################

body action measure
{
measurement_class => "Detect Changes in /usr";
ifelapsed => "240";
expireafter => "240";
}

</pre>

   <p>Some basic anomaly detection: we respond with simple warnings
if resource anomalies are detected.

<pre class="verbatim">#######################################################
# Anomaly monitoring
#######################################################

bundle agent anomalies
{
reports:

rootprocs_high_dev2::

   "RootProc anomaly high 2 dev on $(mon.host) at $(mon.env_time) 
    measured value $(mon.value_rootprocs) av $(mon.av_rootprocs) 
    pm $(mon.dev_rootprocs)"

      showstate => { "rootprocs" };

entropy_www_in_high&amp;anomaly_hosts.www_in_high_anomaly::

   "HIGH ENTROPY Incoming www anomaly high anomaly dev!! 
    on $(mon.host) at $(mon.env_time) 
    - measured value $(mon.value_www_in) 
    av $(mon.av_www_in) pm $(mon.dev_www_in)"
   
      showstate => { "incoming.www" };

 entropy_www_in_low.anomaly_hosts.www_in_high_anomaly::

   "LOW ENTROPY Incoming www anomaly high anomaly dev!! 
    on $(mon.host) at $(mon.env_time)
     - measured value $(svalue_www_in) 
    av $(av_www_in) pm $(dev_www_in)"

     showstate => { "incoming.www" };

entropy_tcpsyn_in_low.anomaly_hosts.tcpsyn_in_high_dev2::

   "Anomalous number of new TCP connections on $(mon.host) 
    at $(mon.env_time) 
    - measured value $(mon.value_tcpsyn_in) 
    av $(mon.av_tcpsyn_in) pm $(mon.dev_tcpsyn_in)"

     showstate => { "incoming.tcpsyn" };

 entropy_dns_in_low.anomaly_hosts.dns_in_high_anomaly::

   "Anomalous (3dev) incoming DNS packets on $(mon.host) 
    at $(mon.env_time) - measured value $(mon.value_dns_in) 
    av $(av_dns_in) pm $(mon.dev_dns_in)"
   
     showstate => { "incoming.dns" };

 entropy_dns_in_low.anomaly_hosts.udp_in_high_dev2::

   "Anomalous (2dev) incoming (non-DNS) UDP traffic 
    on $(mon.host) at $(mon.env_time) - measured value 
    $(mon.value_udp_in) av $(mon.av_udp_in) pm $(mon.dev_udp_in)"

     showstate => { "incoming.udp" };

 anomaly_hosts.icmp_in_high_anomaly.!entropy_icmp_in_high::

   "Anomalous low entropy (3dev) incoming ICMP traffic 
    on $(mon.host) at $(mon.env_time) - measured value $(mon.value_icmp_in) 
    av $(mon.av_icmp_in) pm $(mon.dev_icmp_in)"
   
     showstate => { "incoming.icmp" };
}

</pre>

   <p>Server access rules are a touchy business. In an enterprise
setting you generally want every host to allow a monitoring
host to be able to download data, and a backup host to be able
to access important data on every host. On a laptop or personal
workstation, there might not be any reason to run a server
for external use; however you might configure it as below
to allow localhost access for testing.

<pre class="verbatim">
#######################################################
# Server configuration
#######################################################

bundle server access_rules()
{
access:

  "/home/mark/test_area"

    admit   => { "127.0.0.1" };

  # Rule for cf-runagent

  "/home/mark/.cfagent/bin/cf-agent"

    admit   => { "127.0.0.1" };

# New in cf3 - RBAC with cf-runagent

roles:

  ".*"  authorize => { "mark" };
}

</pre>

<div class="node">
<p><hr>
<a name="update.cf"></a>
<a name="update_002ecf"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#failsafe_002ecf">failsafe.cf</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#site_002ecf">site.cf</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#A-complete-configuration">A complete configuration</a>

</div>

<h3 class="section">4.3 <samp><span class="file">update.cf</span></samp></h3>

<p>This file should never change. If you ever change it, or when you
upgrade cfengine, make sure the old and the new cfengine can
parse and execute this file. If not, you risk losing control of
your system.

<pre class="verbatim">#########################################################
#
# update.cf
#
#########################################################

bundle agent update
{
vars:

 "master_location" string => "/your/master/cfengine-inputs";

files:

  # Update the configuration

  "/var/cfengine/inputs" 

    perms => system("600"),
    copy_from => mycopy("$(master_location)","localhost"),
    depth_search => recurse("inf"),
    action => immediate;

  # Update the software cache

  "/var/cfengine/bin" 

    perms => system("700"),
    copy_from => mycopy("/usr/local/sbin","localhost"),
    depth_search => recurse("inf"),
    action => immediate;
}

############################################

body perms system(p)

{
mode  => "$(p)";
}

############################################

body file_select cf3_files

{
leaf_name => { "cf-.*" };

file_result => "leaf_name";
}

#########################################################

body copy_from mycopy(from,server)

{
source      => "$(from)";
compare     => "digest";
}

#########################################################

body action immediate
{
ifelapsed => "1";
}
</pre>

<div class="node">
<p><hr>
<a name="failsafe.cf"></a>
<a name="failsafe_002ecf"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#What-should-a-failsafe-or-update-file-contain">What should a failsafe or update file contain</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#update_002ecf">update.cf</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#A-complete-configuration">A complete configuration</a>

</div>

<h3 class="section">4.4 <samp><span class="file">failsafe.cf</span></samp></h3>

<p>This file should never change. If you ever change it, or when you
upgrade cfengine, make sure the old and the new cfengine can
parse and execute this file. If not, you risk losing control of
your system.

<pre class="verbatim">#########################################################
#
# Failsafe file
#
#########################################################

body common control

{
bundlesequence => { "update" };

inputs => { "update.cf" };
}

############################################

body depth_search recurse(d)

{
depth => "$(d)";
}

</pre>

<div class="node">
<p><hr>
<a name="What-should-a-failsafe-or-update-file-contain"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Recovery-from-errors-in-the-configuration">Recovery from errors in the configuration</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#failsafe_002ecf">failsafe.cf</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#A-complete-configuration">A complete configuration</a>

</div>

<h3 class="section">4.5 What should a failsafe and update file contain?</h3>

<p>The <samp><span class="file">failsafe.cf</span></samp> file is to make sure that your system can
upgrade gracefully to new versions even when mistakes are made.

   <p>As a general rule:
     <ul>
<li>Upgrade the software first, then add new features
to the configuration.

     <li>Never use advanced features in the failsafe or update file.

     <li>Avoid using library code. Paste it in explicitly using a special
name that does not collide with a name in library. The update
process should not have <i>any</i> dependencies.

   </ul>

<p class="noindent">A cfengine configuration will fail-over to the failsafe configuration
if it is unable to read or parse the contents successfully. That means
that any new features you try in a configuration will cause a
fail-over, because the parser will not be able to interpret the new
features until the software itself has been updated.

<div class="node">
<p><hr>
<a name="Recovery-from-errors-in-the-configuration"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Recovery-from-errors-in-the-software">Recovery from errors in the software</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#What-should-a-failsafe-or-update-file-contain">What should a failsafe or update file contain</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#A-complete-configuration">A complete configuration</a>

</div>

<h3 class="section">4.6 Recovery from errors in the configuration</h3>

<p>The <samp><span class="file">failsafe.cf</span></samp> file should be able to download the latest
master configuration from source always.

<pre class="verbatim">
#######################################################
#
# failsafe.cf
#
#######################################################

body common control

{
bundlesequence => { "update" };
}

#########################################################

bundle agent update
{
files:

  "/var/cfengine/inputs" 

    perms => system,
    copy_from => mycopy("/home/mark/cfengine-inputs","localhost"),
    depth_search => recurse("inf");

  "/var/cfengine/bin" 

    perms => system,
    copy_from => mycopy("/usr/local/sbin","localhost"),
    depth_search => recurse("inf");

}

#########################################################

body perms system

{
mode  => "0700";
}

#########################################################

body depth_search recurse(d)

{
depth => "$(d)";
}

############################################

body file_select cf3_files

{
leaf_name => { "cf-.*" };

file_result => "leaf_name";
}

#########################################################

body copy_from mycopy(from,server)

{
source       => "$(from)";
servers      => { "$(server)" , "failover.domain.tld" };
#copy_backup => "true";
#trustkey    => "true";
encrypt      => "true";
}

</pre>

<p class="noindent">If the <code>copy_backup</code> option is true, cfengine will keep a single
previous version of the file before copy, if the value is &lsquo;<samp><span class="samp">timestamp</span></samp>&rsquo;
cfengine keeps time-stamped versions either in the location of the file, or in the
file repository if one is defined. The <code>trustkey</code> option should normally
be commented out so that public keys are only exchanged under controlled conditions.

<div class="node">
<p><hr>
<a name="Recovery-from-errors-in-the-software"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Recovery-from-errors-in-the-configuration">Recovery from errors in the configuration</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#A-complete-configuration">A complete configuration</a>

</div>

<h3 class="section">4.7 Recovery from errors in the software</h3>

<p>The update should optionally include an update of software
so that a single failover from a configuration that is `too new'
for the software will still correct itself once the new software
is available.

<pre class="verbatim">
#######################################################
#
# update.cf
#
#######################################################

bundle agent update

{
files:

  "/var/cfengine/inputs" 

    perms => system("600"),
    copy_from => mycopy("/home/mark/cfengine-inputs","localhost"),
    depth_search => recurse("inf");

  "/var/cfengine/bin" 

    perms => system("700"),
    copy_from => mycopy("/usr/local/sbin","localhost"),
    file_select => cf3_files,
    depth_search => recurse("inf");

}

############################################

body perms system(p)

{
mode  => "$(p)";
}

############################################

body file_select cf3_files

{
leaf_name => { "cf-.*" };

file_result => "leaf_name";
}

#########################################################

body copy_from mycopy(from,server)

{
source      => "$(from)";
compare     => "digest";
}

</pre>

<!-- ***************************************************** -->
<!-- * CHAPTER -->
<!-- ***************************************************** -->
<div class="node">
<p><hr>
<a name="Control-Promises"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Bundles-for-common">Bundles for common</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#A-complete-configuration">A complete configuration</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Top">Top</a>

</div>

<h2 class="chapter">5 Control promises</h2>

<p><br>

   <p>While promises to configure your system are entirley user-defined, the
details of the operational behaviour of the cfengine software is of
course hard-coded. You can still configure the details of this
behaviour using the control promise bodies. Control behaviour is
defined in bodies because the actual promises are fixed and you only
change their details within sensible limits.

   <p>Note that in cfengine's previous versions, the <code>control</code> part of
the configuration contained a mixture of internal control parameters
and user definitions. There is now a cleaner separation in
cfengine 3. User defined behaviour requires a promise, and must
therefore be defined in a bundle.

   <p>Below is a list of the control parameters for the different components
(Agents and Daemons<a rel="footnote" href="#fn-2" name="fnd-2"><sup>2</sup></a>) of the cfengine software.

<ul class="menu">
<li><a accesskey="1" href="#control-common">control common</a>
<li><a accesskey="2" href="#control-agent">control agent</a>
<li><a accesskey="3" href="#control-server">control server</a>
<li><a accesskey="4" href="#control-monitor">control monitor</a>
<li><a accesskey="5" href="#control-runagent">control runagent</a>
<li><a accesskey="6" href="#control-executor">control executor</a>
<li><a accesskey="7" href="#control-knowledge">control knowledge</a>
<li><a accesskey="8" href="#control-reporter">control reporter</a>
</ul>

<div class="node">
<p><hr>
<a name="control-common"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#control-agent">control agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Control-Promises">Control Promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Control-Promises">Control Promises</a>

</div>

<h3 class="section">5.1 <code>common</code> control promises</h3>

<p><br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
     body common control
     
     {
     inputs  =&gt; {
                "update.cf",
                "library.cf"
                };
     
     bundlesequence  =&gt; {
                        update("policy_host.domain.tld"),
                        "main",
                        "cfengine2"
                        };
     
     output_prefix =&gt; "cfengine&gt;";
     version =&gt; "1.2.3";
     }
     
</pre>
   </td></tr></table>

   <p><br>

   <p>the <code>common</code> control body refers to those promises that are
hard-coded into all the components of cfengine, and therefore affect
the behaviour of all the components.

<ul class="menu">
<li><a accesskey="1" href="#bundlesequence-in-common">bundlesequence in common</a>
<li><a accesskey="2" href="#inputs-in-common">inputs in common</a>
<li><a accesskey="3" href="#version-in-common">version in common</a>
<li><a accesskey="4" href="#lastseenexpireafter-in-common">lastseenexpireafter in common</a>
<li><a accesskey="5" href="#output_005fprefix-in-common">output_prefix in common</a>
<li><a accesskey="6" href="#domain-in-common">domain in common</a>
<li><a accesskey="7" href="#require_005fcomments-in-common">require_comments in common</a>
</ul>

<div class="node">
<p><hr>
<a name="bundlesequence-in-common"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#inputs-in-common">inputs in common</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#control-common">control common</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-common">control common</a>

</div>

<h4 class="subsection">5.1.1 <code>bundlesequence</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: <code>.*</code>

<p class="noindent"><b>Synopsis</b>: List of promise bundles to verify in order

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">body common control

{
#..
bundlesequence  => {
                   update("policy_host.domain.tld"),
                   "main",
                   "cfengine2"
                   };
}
</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The <code>bundlesequence</code> determines whether compiled bundles will be executed and
in what order they will be executed. The list refers to the names of bundles
which might be parameterized function-like objects.

   <p>The <code>bundlesequence</code> is like a genetic makeup of a machine. The bundles
act like characteristics of the systems. If you want different systems to have
different bundlesequences, distinguish them with classes:

<pre class="verbatim">webservers::

  bundlesequence => { "main", "web" };

others::

  bundlesequence => { "main", "otherstuff" };

</pre>

   <p>If you want to add a basic common sequence to all sequences, then use
global variable lists to do this:

<pre class="verbatim">body agent control
{
webservers::

  bundlesequence => { @(g.bs), "web" };

others::

  bundlesequence => { @(g.bs), "otherstuff" };

}

bundle common g
{
vars:

  "bs" slist => { "main", "basic_stuff" }; 
}

</pre>

<div class="node">
<p><hr>
<a name="inputs-in-common"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#version-in-common">version in common</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#bundlesequence-in-common">bundlesequence in common</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-common">control common</a>

</div>

<h4 class="subsection">5.1.2 <code>inputs</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: <code>.*</code>

<p class="noindent"><b>Synopsis</b>: List of filenames to parse for promises

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control
{
inputs  => {
           "update.cf",
           "library.cf"
           };
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="version-in-common"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#lastseenexpireafter-in-common">lastseenexpireafter in common</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#inputs-in-common">inputs in common</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-common">control common</a>

</div>

<h4 class="subsection">5.1.3 <code>version</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: Scalar version string for this configuration

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control
{
version => "1.2.3";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The version string is used in error messages and reports.

<div class="node">
<p><hr>
<a name="lastseenexpireafter-in-common"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#output_005fprefix-in-common">output_prefix in common</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#version-in-common">version in common</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-common">control common</a>

</div>

<h4 class="subsection">5.1.4 <code>lastseenexpireafter</code></h4>

<p class="noindent"><b>Type</b>: int

<p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

<p class="noindent"><b>Synopsis</b>: Number of minutes after which last-seen entries are purged

<p class="noindent"><b>Example</b>:<br>
<br>

<p class="noindent"><b>Notes</b>:<br>
<br>

<pre class="verbatim">
body common control
{
lastseenexpireafter => "72";
}

</pre>

<div class="node">
<p><hr>
<a name="output_prefix-in-common"></a>
<a name="output_005fprefix-in-common"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#domain-in-common">domain in common</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#lastseenexpireafter-in-common">lastseenexpireafter in common</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-common">control common</a>

</div>

<h4 class="subsection">5.1.5 <code>output_prefix</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: The string prefix for standard output

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control
{
output_prefix => "my_cf3";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="domain-in-common"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#require_005fcomments-in-common">require_comments in common</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#output_005fprefix-in-common">output_prefix in common</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-common">control common</a>

</div>

<h4 class="subsection">5.1.6 <code>domain</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>.*</code>

<p class="noindent"><b>Synopsis</b>: Specify the domain name for this host

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control
{
domain => "example.org";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>There is no standard, universal or reliable way of determining the
DNS domain name of a host, so it can be set explicitly to simplify
discovery and name-lookup.

<div class="node">
<p><hr>
<a name="require_comments-in-common"></a>
<a name="require_005fcomments-in-common"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#domain-in-common">domain in common</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-common">control common</a>

</div>

<h4 class="subsection">5.1.7 <code>require_comments</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: Warn about promises that do not have comment documentation

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
common::

require_comments => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This may be used as a policy Quality Assurance measure, to remind
policy makers to properly document their promises. When true,
<code>cf-promises</code> will report loudly on promises that do not have
comments.

<div class="node">
<p><hr>
<a name="control-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#control-server">control server</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#control-common">control common</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Control-Promises">Control Promises</a>

</div>

<h3 class="section">5.2 <code>agent</code> control promises</h3>

<p><br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
     body agent control
     {
     123_456_789::
     
       domain =&gt; "mydomain.com";
     
     123_456_789_111::
     
       auditing =&gt; "true";
     
     any::
     
       fullencryption =&gt; "true";
     
     }
     
</pre>
   </td></tr></table>

   <p><br>

   <p>Settings describing the details of the fixed behavioural promises made by
<code>cf-agent</code>. For example:

<ul class="menu">
<li><a accesskey="1" href="#abortclasses-in-agent">abortclasses in agent</a>
<li><a accesskey="2" href="#abortbundleclasses-in-agent">abortbundleclasses in agent</a>
<li><a accesskey="3" href="#addclasses-in-agent">addclasses in agent</a>
<li><a accesskey="4" href="#agentaccess-in-agent">agentaccess in agent</a>
<li><a accesskey="5" href="#agentfacility-in-agent">agentfacility in agent</a>
<li><a accesskey="6" href="#auditing-in-agent">auditing in agent</a>
<li><a accesskey="7" href="#binarypaddingchar-in-agent">binarypaddingchar in agent</a>
<li><a accesskey="8" href="#bindtointerface-in-agent">bindtointerface in agent</a>
<li><a accesskey="9" href="#hashupdates-in-agent">hashupdates in agent</a>
<li><a href="#childlibpath-in-agent">childlibpath in agent</a>
<li><a href="#defaultcopytype-in-agent">defaultcopytype in agent</a>
<li><a href="#dryrun-in-agent">dryrun in agent</a>
<li><a href="#editbinaryfilesize-in-agent">editbinaryfilesize in agent</a>
<li><a href="#editfilesize-in-agent">editfilesize in agent</a>
<li><a href="#environment-in-agent">environment in agent</a>
<li><a href="#exclamation-in-agent">exclamation in agent</a>
<li><a href="#expireafter-in-agent">expireafter in agent</a>
<li><a href="#files_005fsingle_005fcopy-in-agent">files_single_copy in agent</a>
<li><a href="#files_005fauto_005fdefine-in-agent">files_auto_define in agent</a>
<li><a href="#fullencryption-in-agent">fullencryption in agent</a>
<li><a href="#hostnamekeys-in-agent">hostnamekeys in agent</a>
<li><a href="#ifelapsed-in-agent">ifelapsed in agent</a>
<li><a href="#inform-in-agent">inform in agent</a>
<li><a href="#lastseen-in-agent">lastseen in agent</a>
<li><a href="#intermittency-in-agent">intermittency in agent</a>
<li><a href="#max_005fchildren-in-agent">max_children in agent</a>
<li><a href="#maxconnections-in-agent">maxconnections in agent</a>
<li><a href="#mountfilesystems-in-agent">mountfilesystems in agent</a>
<li><a href="#nonalphanumfiles-in-agent">nonalphanumfiles in agent</a>
<li><a href="#repchar-in-agent">repchar in agent</a>
<li><a href="#default_005frepository-in-agent">default_repository in agent</a>
<li><a href="#secureinput-in-agent">secureinput in agent</a>
<li><a href="#sensiblecount-in-agent">sensiblecount in agent</a>
<li><a href="#sensiblesize-in-agent">sensiblesize in agent</a>
<li><a href="#skipidentify-in-agent">skipidentify in agent</a>
<li><a href="#suspiciousnames-in-agent">suspiciousnames in agent</a>
<li><a href="#syslog-in-agent">syslog in agent</a>
<li><a href="#timezone-in-agent">timezone in agent</a>
<li><a href="#default_005ftimeout-in-agent">default_timeout in agent</a>
<li><a href="#verbose-in-agent">verbose in agent</a>
</ul>

<div class="node">
<p><hr>
<a name="abortclasses-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#abortbundleclasses-in-agent">abortbundleclasses in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#control-agent">control agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.1 <code>abortclasses</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: <code>.*</code>

<p class="noindent"><b>Synopsis</b>: A list of classes which if defined lead to termination of cf-agent

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
 body agent control

  {
  abortclasses => { "danger", "should_not_continue" };
  }

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>A list of classes that <code>cf-agent</code> will watch out for. If any of
these classes becomes defined, it will cause the current execution of
<code>cf-agent</code> to be aborted. This may be used for validation, for
example.

<div class="node">
<p><hr>
<a name="abortbundleclasses-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#addclasses-in-agent">addclasses in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#abortclasses-in-agent">abortclasses in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.2 <code>abortbundleclasses</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: <code>.*</code>

<p class="noindent"><b>Synopsis</b>: A list of classes which if defined lead to termination of current bundle

<p class="noindent"><b>Example</b>:<br>
<br>

   <p>This example shows how to use the feature to validate input to a method bundle.

<pre class="verbatim">
body common control

{
bundlesequence  => { "testbundle"  };
version => "1.2.3";
}

###########################################

body agent control

{
abortbundleclasses => { "invalid" };
}

###########################################

bundle agent testbundle
{
vars:

 "userlist" slist => { "xyz", "mark", "jeang", "jonhenrik", "thomas", "eben" };

methods:

 "any" usebundle => subtest("$(userlist)");

}

###########################################

bundle agent subtest(user)

{
classes:

  "invalid" not => regcmp("[a-z][a-z][a-z][a-z]","$(user)");

reports:

 !invalid::

  "User name $(user) is valid at 4 letters";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>A list of classes that <code>cf-agent</code> will watch out for. If any of
these classes becomes defined, it will cause the current bundle to be
aborted. This may be used for validation, for example.

<div class="node">
<p><hr>
<a name="addclasses-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#agentaccess-in-agent">agentaccess in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#abortbundleclasses-in-agent">abortbundleclasses in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.3 <code>addclasses</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: <code>.*</code>

<p class="noindent"><b>Synopsis</b>: A list of classes to be defined always in the current context

<p class="noindent"><b>Example</b>:<br>
<br>

   <p>Add classes adds global, literal classes. The only predicates available during the control
section are hard-classes.

<pre class="verbatim">
any::

  addclasses => { "My_Organization" }

solaris::

  addclasses => { "some_solaris_alive", "running_on_sunshine" };


</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Another place to make global aliases for system hardclasses. Classes
here are added unqeuivocally to the system. If classes are used to
predicate definition, then they must be defined in terms of global
hard classes.

<div class="node">
<p><hr>
<a name="agentaccess-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#agentfacility-in-agent">agentfacility in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#addclasses-in-agent">addclasses in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.4 <code>agentaccess</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: <code>.*</code>

<p class="noindent"><b>Synopsis</b>: A list of user names allowed to execute cf-agent

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
 agentaccess => { "mark", "root", "sudo" };

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>A list of user names that will be allowed to attempt execution of the
current configuration. This is mainly a sanity check rather than a
security measure.

<div class="node">
<p><hr>
<a name="agentfacility-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#auditing-in-agent">auditing in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#agentaccess-in-agent">agentaccess in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.5 <code>agentfacility</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>LOG_USER</code>
               <code>LOG_DAEMON</code>
               <code>LOG_LOCAL0</code>
               <code>LOG_LOCAL1</code>
               <code>LOG_LOCAL2</code>
               <code>LOG_LOCAL3</code>
               <code>LOG_LOCAL4</code>
               <code>LOG_LOCAL5</code>
               <code>LOG_LOCAL6</code>
               <code>LOG_LOCAL7</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: The syslog facility for cf-agent

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
agentfacility => "LOG_USER";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Sets the agent's syslog facility level. See the manual pages for syslog.

<div class="node">
<p><hr>
<a name="auditing-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#binarypaddingchar-in-agent">binarypaddingchar in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#agentfacility-in-agent">agentfacility in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.6 <code>auditing</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false flag to activate the cf-agent audit log

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
auditing  => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If this is set, cfengine will perform auditing on promises in the
current configuration. This means that all details surrounding the
verification of the current promise will be recorded in the audit
database. The database may be inspected with <code>cf-report</code>, or
<code>cfshow</code> in cfengine 2.

<div class="node">
<p><hr>
<a name="binarypaddingchar-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#bindtointerface-in-agent">bindtointerface in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#auditing-in-agent">auditing in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.7 <code>binarypaddingchar</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: Character used to pad unequal replacements in binary editing

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
binarypaddingchar => "$(const.0)";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>When editing binary files, it can be dangerous to replace a text
string with one that is longer or shorter as byte references and jumps
would be destroyed. Cfengine will therefore not allow replacements that
are larger in size than the original, but shorter strings can be padded
out to the same length.

<div class="node">
<p><hr>
<a name="bindtointerface-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#hashupdates-in-agent">hashupdates in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#binarypaddingchar-in-agent">binarypaddingchar in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.8 <code>bindtointerface</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>.*</code>

<p class="noindent"><b>Synopsis</b>: Use this interface for outgoing connections

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
bindtointerface => "192.168.1.1";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>On multi-homed hosts, the server and client can bind
to a specific interface for server traffic. The IP address
of the interface must be given as the argument, not the device name.

<div class="node">
<p><hr>
<a name="hashupdates-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#childlibpath-in-agent">childlibpath in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#bindtointerface-in-agent">bindtointerface in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.9 <code>hashupdates</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false whether stored hashes are updated when change is detected in source

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">body agent control
{
hashupdates => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If &lsquo;<samp><span class="samp">true</span></samp>&rsquo; the stored reference value is updated as soon as a warning
message has been given. As most changes are benign (package updates etc)
this is a common setting.

<div class="node">
<p><hr>
<a name="childlibpath-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#defaultcopytype-in-agent">defaultcopytype in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#hashupdates-in-agent">hashupdates in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.10 <code>childlibpath</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>.*</code>

<p class="noindent"><b>Synopsis</b>: LD_LIBRARY_PATH for child processes

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
childlibpath => "/usr/lcoal/lib:/usr/local/gnu/lib";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This string may be used to set the internal <code>LD_LIBRARY_PATH</code>
environment of the agent.

<div class="node">
<p><hr>
<a name="defaultcopytype-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#dryrun-in-agent">dryrun in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#childlibpath-in-agent">childlibpath in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.11 <code>defaultcopytype</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>mtime</code>
               <code>atime</code>
               <code>ctime</code>
               <code>digest</code>
               <code>hash</code>
               <code>binary</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: (null)

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
#...
defaultcopytype => "digest";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Sets the global default policy for comparing source and image in copy transactions.

<div class="node">
<p><hr>
<a name="dryrun-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#editbinaryfilesize-in-agent">editbinaryfilesize in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#defaultcopytype-in-agent">defaultcopytype in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.12 <code>dryrun</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: All talk and no action mode

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
dryrun => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If set in the configuration, cfengine makes no changes to a
system, only reports what it needs to do.

<div class="node">
<p><hr>
<a name="editbinaryfilesize-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#editfilesize-in-agent">editfilesize in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#dryrun-in-agent">dryrun in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.13 <code>editbinaryfilesize</code></h4>

<p class="noindent"><b>Type</b>: int

<p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

<p class="noindent"><b>Synopsis</b>: Integer limit on maximum binary file size to be edited

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
edibinaryfilesize => "10M";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The limit on editing binary files should generally be higher than for text files. 
Note the use of units allowed in the integer type.

<div class="node">
<p><hr>
<a name="editfilesize-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#environment-in-agent">environment in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#editbinaryfilesize-in-agent">editbinaryfilesize in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.14 <code>editfilesize</code></h4>

<p class="noindent"><b>Type</b>: int

<p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

<p class="noindent"><b>Synopsis</b>: Integer limit on maximum text file size to be edited

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
editfilesize => "120k";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The global setting for the file-editing safety-net. Note the use of special units is allowed.

<div class="node">
<p><hr>
<a name="environment-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#exclamation-in-agent">exclamation in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#editfilesize-in-agent">editfilesize in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.15 <code>environment</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: <code>[A-Za-z_]+=.*</code>

<p class="noindent"><b>Synopsis</b>: List of environment variables to be inherited by children

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control
{
bundlesequence => { "one" };
}

body agent control
{
environment => { "A=123", "B=456", "PGK_PATH=/tmp"};
}

bundle agent one
{
commands:

  "/usr/bin/env";
}
</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This may be used to set the runtime environment of the agent process. The values of environment variables
are inherited by child commands. Some interactive programs insist on values being set, e.g.

<pre class="verbatim">
# Required by apt-cache, debian

environment => { "LANG=C"};

</pre>

<div class="node">
<p><hr>
<a name="exclamation-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#expireafter-in-agent">expireafter in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#environment-in-agent">environment in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.16 <code>exclamation</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false print exclamation marks during security warnings

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
exclamation => "false";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This affects only the output format of warnings.

<div class="node">
<p><hr>
<a name="expireafter-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#files_005fsingle_005fcopy-in-agent">files_single_copy in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#exclamation-in-agent">exclamation in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.17 <code>expireafter</code></h4>

<p class="noindent"><b>Type</b>: int

<p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

<p class="noindent"><b>Synopsis</b>: Global default for time before on-going promise repairs are interrupted

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">body action example
{
ifelapsed   => "120";
expireafter => "240";
}
</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The locking time after which cfengine will attempt to kill and restart
its attempt to keep a promise.

<div class="node">
<p><hr>
<a name="files_single_copy-in-agent"></a>
<a name="files_005fsingle_005fcopy-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#files_005fauto_005fdefine-in-agent">files_auto_define in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#expireafter-in-agent">expireafter in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.18 <code>files_single_copy</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: List of filenames to be watched for multiple-source conflicts

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
single_copy => { "/etc/.*", "/special/file" };
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This list of regular expressions will ensure that files matching the
patterns of the list are never copied from more than one source during
a single run of <code>cf-agent</code>. This may be considered a protection
against accidential overlap of copies from diverse remote sources, or
as a first-come-first-served disambiguation tool for lazy-evaluation
of overlapping file-copy promises.

<div class="node">
<p><hr>
<a name="files_auto_define-in-agent"></a>
<a name="files_005fauto_005fdefine-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#fullencryption-in-agent">fullencryption in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#files_005fsingle_005fcopy-in-agent">files_single_copy in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.19 <code>files_auto_define</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: List of filenames to define classes if copied

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
files_auto_define => { "/etc/syslog\.c.*", "/etc/passwd" };
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Classes are automatically defined by the files that are copied.  The
file is named according to the prefixed `canonization' of the file
name.  Canonization means that non-identifier characters are converted
into underscores. Thus <samp><span class="file">/etc/passwd</span></samp> would canonize to
&lsquo;<samp><span class="samp">_etc_passwd</span></samp>&rsquo;. The prefix &lsquo;<samp><span class="samp">auto_</span></samp>&rsquo; is added to clarify the
origin of the class. Thus in the example the copying of
<samp><span class="file">/etc/passwd</span></samp> would lead to the class &lsquo;<samp><span class="samp">auto__etc_passwd</span></samp>&rsquo;
being defined automatically.

<div class="node">
<p><hr>
<a name="fullencryption-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#hostnamekeys-in-agent">hostnamekeys in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#files_005fauto_005fdefine-in-agent">files_auto_define in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.20 <code>fullencryption</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: Full encryption mode in server connections, includes directory listings

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
fullencryption => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If true this encrypts all levels of the queries to the server during
file transfers. The default is to not encrypt all aspects, since this
can slow down transfer and basically only contributes to global
warming for most users.

<div class="node">
<p><hr>
<a name="hostnamekeys-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#ifelapsed-in-agent">ifelapsed in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#fullencryption-in-agent">fullencryption in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.21 <code>hostnamekeys</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false label ppkeys by hostname not IP address

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body server control
{
hostnamekeys => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Client side choice to base key associations on host names rather than IP address. 
This is useful for hosts with dynamic addresses.

<div class="node">
<p><hr>
<a name="ifelapsed-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#inform-in-agent">inform in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#hostnamekeys-in-agent">hostnamekeys in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.22 <code>ifelapsed</code></h4>

<p class="noindent"><b>Type</b>: int

<p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

<p class="noindent"><b>Synopsis</b>: Global default for time that must elapse before promise will be rechecked

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
#local

body action example
{
ifelapsed   => "120";
expireafter => "240";
}

# global

body agent control
{
ifelapsed   => "120";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This overrides the global settings. Promises which take a long time to
verify should usually be protected with a long value for this
parameter.  This serves as a resource `spam' protection. A cfengine
check could easily run every 5 minutes provided resource intensive
operations are not performed on every run. Using time classes like
<code>Hr12</code> etc., is one part of this strategy; using <code>ifelapsed</code>
is another which is not tied to a specific time.

<div class="node">
<p><hr>
<a name="inform-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#lastseen-in-agent">lastseen in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#ifelapsed-in-agent">ifelapsed in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.23 <code>inform</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false set inform level default

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
inform => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Equivalent to or overrides the command line option &lsquo;<samp><span class="samp">-I</span></samp>&rsquo;. Sets the
default output level `permanently' within the class context indicated.

<div class="node">
<p><hr>
<a name="lastseen-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#intermittency-in-agent">intermittency in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#inform-in-agent">inform in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.24 <code>lastseen</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false record last observed time for all client-server connections (true)

<p class="noindent"><b>Example</b>:<br>
<br>

   <p>In control:
<pre class="verbatim">
body agent control
{
lastseen => "false";
}

</pre>

   <p>See also in reports:
<pre class="verbatim">
reports:

  "Comment"

    lastseen => "10";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>In reports: after this time (hours) has passed, references to the external peer
will be purged from this host's database.

   <p>In control: determines whether cfengine will records last seen
intermittency profiles (reliability diagnostics) in
<samp><span class="file">WORKDIR/lastseen</span></samp>. This generates a separate file for each each
host that connects to the current host.  For central hubs this can
result is a huge number of files.

<div class="node">
<p><hr>
<a name="intermittency-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#max_005fchildren-in-agent">max_children in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#lastseen-in-agent">lastseen in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.25 <code>intermittency</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false store detailed recordings of last observed time for all client-server connections for reliability assessment (false)

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
reports:

  "Comment"

    intermittency => "0.5";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Report on cfengine peers in the neighbourhood watch whose observed
irregularity of connection exceeds 0.5 scaled entropy units, meaning
that they show an erratic pattern of connection.

<div class="node">
<p><hr>
<a name="max_children-in-agent"></a>
<a name="max_005fchildren-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#maxconnections-in-agent">maxconnections in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#intermittency-in-agent">intermittency in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.26 <code>max_children</code></h4>

<p class="noindent"><b>Type</b>: int

<p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

<p class="noindent"><b>Synopsis</b>: Maximum number of background tasks that should be allowed concurrently

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body runagent control
{
max_children => "10";
}

# or

body agent control
{
max_children => "10";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>For the run-agent this represents the maximum number of forked
background processes allowed when parallelizing connections to
servers. For the agent it represents the number of background jobs
allowed concurrently. Background jobs often lead to contention of
the disk resources slowing down tasks considerably; there is thus a law
of diminishing returns.

<div class="node">
<p><hr>
<a name="maxconnections-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#mountfilesystems-in-agent">mountfilesystems in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#max_005fchildren-in-agent">max_children in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.27 <code>maxconnections</code></h4>

<p class="noindent"><b>Type</b>: int

<p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

<p class="noindent"><b>Synopsis</b>: Maximum number of outgoing connections to cf-serverd

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
# client side 

body agent control
{
maxconnections => "1000";
}

# server side

body server control
{
maxconnections => "1000";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Watch out for kernel limitations for maximum numbers of open file descriptors
which can limit this.

<div class="node">
<p><hr>
<a name="mountfilesystems-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#nonalphanumfiles-in-agent">nonalphanumfiles in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#maxconnections-in-agent">maxconnections in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.28 <code>mountfilesystems</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false mount any filesystems promised

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
mountfilesystems => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Issues the generic command to mount file systems defined in the file system table.

<div class="node">
<p><hr>
<a name="nonalphanumfiles-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#repchar-in-agent">repchar in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#mountfilesystems-in-agent">mountfilesystems in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.29 <code>nonalphanumfiles</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false warn about filenames with no alphanumeric content

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
nonalphanumericfiles => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This test is applied in all recursive/depth searches.

<div class="node">
<p><hr>
<a name="repchar-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#default_005frepository-in-agent">default_repository in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#nonalphanumfiles-in-agent">nonalphanumfiles in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.30 <code>repchar</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>.</code>

<p class="noindent"><b>Synopsis</b>: The character used to canonize pathnames in the file repository

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
repchar => "_";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="default_repository-in-agent"></a>
<a name="default_005frepository-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#secureinput-in-agent">secureinput in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#repchar-in-agent">repchar in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.31 <code>default_repository</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

<p class="noindent"><b>Synopsis</b>: Path to the default file repository

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
default_respository => "/var/cfengine/repository";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If defined the default repository is the location where versions of
files altered by cfengine are stored. This should be understood in
relation to the policy for &lsquo;<samp><span class="samp">backup</span></samp>&rsquo; in copying, editing etc.  If
the backups are time-stamped, this becomes effective a version control
repository.

<div class="node">
<p><hr>
<a name="secureinput-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#sensiblecount-in-agent">sensiblecount in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#default_005frepository-in-agent">default_repository in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.32 <code>secureinput</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false check whether input files are writable by unauthorized users

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
secureinput => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If this is set, the agent will not accept an input file that is not owned
by a privileged user.

<div class="node">
<p><hr>
<a name="sensiblecount-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#sensiblesize-in-agent">sensiblesize in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#secureinput-in-agent">secureinput in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.33 <code>sensiblecount</code></h4>

<p class="noindent"><b>Type</b>: int

<p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

<p class="noindent"><b>Synopsis</b>: Minimum number of files a mounted filesystem is expected to have

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control 
{
sensiblecount => "20";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="sensiblesize-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#skipidentify-in-agent">skipidentify in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#sensiblecount-in-agent">sensiblecount in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.34 <code>sensiblesize</code></h4>

<p class="noindent"><b>Type</b>: int

<p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

<p class="noindent"><b>Synopsis</b>: Minimum number of bytes a mounted filesystem is expected to have

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
sensiblesize => "20K";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="skipidentify-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#suspiciousnames-in-agent">suspiciousnames in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#sensiblesize-in-agent">sensiblesize in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.35 <code>skipidentify</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: Do not send IP/name during server connection because address resolution is broken

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
skipidentify => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Hosts that are not registered in DNS cannot supply reasonable credentials
for a secondary confirmation of their identity to a cfengine server. This
causes the agent to ignore its missing DNS credentials.

<div class="node">
<p><hr>
<a name="suspiciousnames-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#syslog-in-agent">syslog in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#skipidentify-in-agent">skipidentify in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.36 <code>suspiciousnames</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: <code>List of names to warn about if found during any file search</code>

<p class="noindent"><b>Synopsis</b>: (null)

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
suspiciousnames => { ".mo", "lrk3", "rootkit" };
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If cfengine sees these names during recursive (depth) file searches it will
warn about them.

<div class="node">
<p><hr>
<a name="syslog-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#timezone-in-agent">timezone in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#suspiciousnames-in-agent">suspiciousnames in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.37 <code>syslog</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false switches on output to syslog at the inform level

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent example
{
syslog => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="timezone-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#default_005ftimeout-in-agent">default_timeout in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#syslog-in-agent">syslog in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.38 <code>timezone</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: List of allowed timezones this machine must comply with

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
timezone => { "MET", "CET", "GMT+1" };
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="default_timeout-in-agent"></a>
<a name="default_005ftimeout-in-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#verbose-in-agent">verbose in agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#timezone-in-agent">timezone in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.39 <code>default_timeout</code></h4>

<p class="noindent"><b>Type</b>: int

<p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

<p class="noindent"><b>Synopsis</b>: Maximum time a network connection should attempt to connect

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
default_timeout => "10";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The time is in seconds. It is not a guaranteed number, since it
depends on system behaviour. under Linux, the kernel version plays a
role, since not all system calls seem to respect the signals.

<div class="node">
<p><hr>
<a name="verbose-in-agent"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#default_005ftimeout-in-agent">default_timeout in agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-agent">control agent</a>

</div>

<h4 class="subsection">5.2.40 <code>verbose</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false switches on verbose standard output

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
verbose => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="control-server"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#control-monitor">control monitor</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#control-agent">control agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Control-Promises">Control Promises</a>

</div>

<h3 class="section">5.3 <code>server</code> control promises</h3>

<p><br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
     body server control
     
     {
     allowconnects         =&gt; { "127.0.0.1" , "::1" ,  ".*.example.org" };
     allowallconnects      =&gt; { "127.0.0.1" , "::1" ,  ".*.example.org" };
     
     # Uncomment me under controlled circumstances
     #trustkeysfrom         =&gt; { "127.0.0.1" , "::1" ,  ".*.example.org" };
     }
     
</pre>
   </td></tr></table>

   <p><br>

   <p>Server controls are mainly about determining access policy for the
connection protocol: i.e. access to the server itself. Access to
specific files must be granted in addition.

<ul class="menu">
<li><a accesskey="1" href="#cfruncommand-in-server">cfruncommand in server</a>
<li><a accesskey="2" href="#maxconnections-in-server">maxconnections in server</a>
<li><a accesskey="3" href="#denybadclocks-in-server">denybadclocks in server</a>
<li><a accesskey="4" href="#allowconnects-in-server">allowconnects in server</a>
<li><a accesskey="5" href="#denyconnects-in-server">denyconnects in server</a>
<li><a accesskey="6" href="#allowallconnects-in-server">allowallconnects in server</a>
<li><a accesskey="7" href="#trustkeysfrom-in-server">trustkeysfrom in server</a>
<li><a accesskey="8" href="#allowusers-in-server">allowusers in server</a>
<li><a accesskey="9" href="#dynamicaddresses-in-server">dynamicaddresses in server</a>
<li><a href="#skipverify-in-server">skipverify in server</a>
<li><a href="#logallconnections-in-server">logallconnections in server</a>
<li><a href="#logencryptedtransfers-in-server">logencryptedtransfers in server</a>
<li><a href="#hostnamekeys-in-server">hostnamekeys in server</a>
<li><a href="#auditing-in-server">auditing in server</a>
<li><a href="#bindtointerface-in-server">bindtointerface in server</a>
<li><a href="#serverfacility-in-server">serverfacility in server</a>
<li><a href="#port-in-server">port in server</a>
</ul>

<div class="node">
<p><hr>
<a name="cfruncommand-in-server"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#maxconnections-in-server">maxconnections in server</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#control-server">control server</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-server">control server</a>

</div>

<h4 class="subsection">5.3.1 <code>cfruncommand</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

<p class="noindent"><b>Synopsis</b>: Path to the cf-agent command or cf-execd wrapper for remote execution

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body server control

{
#..
cfruncommand => "/var/cfengine/bin/cf-agent";
}


</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>It is normal for this to point to the location of <code>cf-agent</code> but
it could also point to the <code>cf-execd</code>, or even another program at
your own risk.

<div class="node">
<p><hr>
<a name="maxconnections-in-server"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#denybadclocks-in-server">denybadclocks in server</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#cfruncommand-in-server">cfruncommand in server</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-server">control server</a>

</div>

<h4 class="subsection">5.3.2 <code>maxconnections</code></h4>

<p class="noindent"><b>Type</b>: int

<p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

<p class="noindent"><b>Synopsis</b>: Maximum number of connections that will be accepted by cf-serverd

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
# client side 

body agent control
{
maxconnections => "1000";
}

# server side

body server control
{
maxconnections => "1000";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Watch out for kernel limitations for maximum numbers of open file descriptors
which can limit this.

<div class="node">
<p><hr>
<a name="denybadclocks-in-server"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#allowconnects-in-server">allowconnects in server</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#maxconnections-in-server">maxconnections in server</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-server">control server</a>

</div>

<h4 class="subsection">5.3.3 <code>denybadclocks</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false accept connections from hosts with clocks that are out of sync

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body server control
{
#..
denybadclocks => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>A possible form of attack on the fileserver is to request files based
on time by setting the clocks incorrectly. This option prevents
connections from clients whose clocks are drifting too far from the
server clock. This serves as a warning about clock asynchronization
and also a protection against Denial of Service attempts based on
clock corruption.

<div class="node">
<p><hr>
<a name="allowconnects-in-server"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#denyconnects-in-server">denyconnects in server</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#denybadclocks-in-server">denybadclocks in server</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-server">control server</a>

</div>

<h4 class="subsection">5.3.4 <code>allowconnects</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: List of IPs or hostnames that may connect to the server port

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
allowconnects         => { 
                         "127.0.0.1" , 
                         "::1", 
                         "2001.10.*" , 
                         "host.domain.tld", 
                         "host[0-9]+\.domain.com" 
                         };

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If a client's identity matches an entry in this list it is granted to
permission to send data to the server port. Clients who are not in this
list may not connect or send data to the server.

<div class="node">
<p><hr>
<a name="denyconnects-in-server"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#allowallconnects-in-server">allowallconnects in server</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#allowconnects-in-server">allowconnects in server</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-server">control server</a>

</div>

<h4 class="subsection">5.3.5 <code>denyconnects</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: List of IPs or hostnames that may NOT connect to the server port

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">body server control
{
denyconnects => { "badhost.domain.evil" };
}
</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Hosts or IP addresses that are explicitly denied access. This should
only be used in special circumstances.  One should never grant generic
access to everything and then deny special cases. Since the default
server behaviour is to grant no access to anything, this list is
unnecessary unless you have already granted access to some set of
hosts using a generic pattern, to which you intend to make an exception.

<div class="node">
<p><hr>
<a name="allowallconnects-in-server"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#trustkeysfrom-in-server">trustkeysfrom in server</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#denyconnects-in-server">denyconnects in server</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-server">control server</a>

</div>

<h4 class="subsection">5.3.6 <code>allowallconnects</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: List of IPs or hostnames that may have more than one connection to the server port

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
allowallconnects      => { 
                         "127.0.0.1" , 
                         "::1", 
                         "2001.10.*" , 
                         "host.domain.tld", 
                         "host[0-9]+\.domain.com" 
                         };

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This list of regular expressions matches hosts that are allowed to
connect an umlimited number of times up to the maximum connection
limit. Without this, a host may only connect once (which is a very
strong constraint, as the host must wait for the TCP FIN_WAIT to
expire before reconnction can be attempted).

   <p>In cfengine 2 this corresponds to <code>AllowMultipleConnectionsFrom</code>.

<div class="node">
<p><hr>
<a name="trustkeysfrom-in-server"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#allowusers-in-server">allowusers in server</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#allowallconnects-in-server">allowallconnects in server</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-server">control server</a>

</div>

<h4 class="subsection">5.3.7 <code>trustkeysfrom</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: List of IPs or hostnames from whom we accept public keys on trust

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body server control
{
trustkeysfrom => {"hosts.*", "192.168.*"};
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If connecting clients' public keys have not already been trusted, this
allows us to say `yes' to accepting the keys on trust. Normally this
should be an empty list except in controlled circumstances.

<div class="node">
<p><hr>
<a name="allowusers-in-server"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#dynamicaddresses-in-server">dynamicaddresses in server</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#trustkeysfrom-in-server">trustkeysfrom in server</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-server">control server</a>

</div>

<h4 class="subsection">5.3.8 <code>allowusers</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: List of usernames who may execute requests from this server

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
allowusers => { "cfengine", "root" };

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The usernames listed in this list are those asserted as public key
identities during client-server connections. These may or may not
correspond to system identities on the server-side system.

<div class="node">
<p><hr>
<a name="dynamicaddresses-in-server"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#skipverify-in-server">skipverify in server</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#allowusers-in-server">allowusers in server</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-server">control server</a>

</div>

<h4 class="subsection">5.3.9 <code>dynamicaddresses</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: List of IPs or hostnames for which the IP/name binding is expected to change

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body server control
{
dynamicaddresses => { "dhcp_.*" };
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The addresses or hostnames here are expected to have non-permanent
address-name bindings, we must therefor work harder to determine
whether hosts credentials are trusted by looking for existing public
keys in files that do not match the current hostname or IP.

<div class="node">
<p><hr>
<a name="skipverify-in-server"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#logallconnections-in-server">logallconnections in server</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#dynamicaddresses-in-server">dynamicaddresses in server</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-server">control server</a>

</div>

<h4 class="subsection">5.3.10 <code>skipverify</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: List of IPs or hostnames for which we expect no DNS binding and cannot verify

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body server control
{
skipverify => { "special_host.*", "192.168.*" };
}
</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Server side decision to ignore requirements of DNS identity confirmation.

<div class="node">
<p><hr>
<a name="logallconnections-in-server"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#logencryptedtransfers-in-server">logencryptedtransfers in server</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#skipverify-in-server">skipverify in server</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-server">control server</a>

</div>

<h4 class="subsection">5.3.11 <code>logallconnections</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false causes the server to log all new connections to syslog

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body server control
{
logallconnections => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If set, the server will record connection attempts in syslog.

<div class="node">
<p><hr>
<a name="logencryptedtransfers-in-server"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#hostnamekeys-in-server">hostnamekeys in server</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#logallconnections-in-server">logallconnections in server</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-server">control server</a>

</div>

<h4 class="subsection">5.3.12 <code>logencryptedtransfers</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false log all successful transfers required to be encrypted

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body server control
{
logencryptedtransfers => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If true the server will log all transfers of files which the server
requires to encrypted in order to grant access (see
<code>ifencrypted</code>) to syslog. These files are deemed to be
particularly sensitive.

<div class="node">
<p><hr>
<a name="hostnamekeys-in-server"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#auditing-in-server">auditing in server</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#logencryptedtransfers-in-server">logencryptedtransfers in server</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-server">control server</a>

</div>

<h4 class="subsection">5.3.13 <code>hostnamekeys</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false store keys using hostname lookup instead of IP addresses

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body server control
{
hostnamekeys => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Client side choice to base key associations on host names rather than IP address. 
This is useful for hosts with dynamic addresses.

<div class="node">
<p><hr>
<a name="auditing-in-server"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#bindtointerface-in-server">bindtointerface in server</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#hostnamekeys-in-server">hostnamekeys in server</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-server">control server</a>

</div>

<h4 class="subsection">5.3.14 <code>auditing</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false activate auditing of server connections

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body agent control
{
auditing  => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If this is set, cfengine will perform auditing on promises in the
current configuration. This means that all details surrounding the
verification of the current promise will be recorded in the audit
database. The database may be inspected with <code>cf-report</code>, or
<code>cfshow</code> in cfengine 2.

<div class="node">
<p><hr>
<a name="bindtointerface-in-server"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#serverfacility-in-server">serverfacility in server</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#auditing-in-server">auditing in server</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-server">control server</a>

</div>

<h4 class="subsection">5.3.15 <code>bindtointerface</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: IP of the interface to which the server should bind on multi-homed hosts

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
bindtointerface => "192.168.1.1";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>On multi-homed hosts, the server and client can bind
to a specific interface for server traffic. The IP address
of the interface must be given as the argument, not the device name.

<div class="node">
<p><hr>
<a name="serverfacility-in-server"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#port-in-server">port in server</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#bindtointerface-in-server">bindtointerface in server</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-server">control server</a>

</div>

<h4 class="subsection">5.3.16 <code>serverfacility</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>LOG_USER</code>
               <code>LOG_DAEMON</code>
               <code>LOG_LOCAL0</code>
               <code>LOG_LOCAL1</code>
               <code>LOG_LOCAL2</code>
               <code>LOG_LOCAL3</code>
               <code>LOG_LOCAL4</code>
               <code>LOG_LOCAL5</code>
               <code>LOG_LOCAL6</code>
               <code>LOG_LOCAL7</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: Menu option for syslog facility level

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body server control
{
serverfacility => "LOG_USER";
}
</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>See syslog notes.

<div class="node">
<p><hr>
<a name="port-in-server"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#serverfacility-in-server">serverfacility in server</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-server">control server</a>

</div>

<h4 class="subsection">5.3.17 <code>port</code></h4>

<p class="noindent"><b>Type</b>: int

<p class="noindent"><b>Allowed input range</b>: <code>1024,99999</code>

<p class="noindent"><b>Synopsis</b>: Default port for cfengine server

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body runagent control
{
port => "5308";
}

body server control
{
specialhost::
 port => "5308";

!specialhost::
 port => "5308";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The standard or registered port number is tcp/5308. Cfengine does not
presently use its registered udp port with the same number, but this
could change in the future.

   <p>Changing the standard port number is not recommended practice. You should
not do it without a good reason.

<div class="node">
<p><hr>
<a name="control-monitor"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#control-runagent">control runagent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#control-server">control server</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Control-Promises">Control Promises</a>

</div>

<h3 class="section">5.4 <code>monitor</code> control promises</h3>

<p><br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
     body monitor control()
        {
        #version =&gt; "1.2.3.4";
     
        threshold =&gt; "0.3";
        forgetrate =&gt; "0.7";
        histograms =&gt; "true";
        tcpdump =&gt; "false";
        tcpdumpcommand =&gt; "/usr/sbin/tcpdump -i eth1 -n -t -v";
     
        }
     
</pre>
   </td></tr></table>

   <p><br>

   <p>The system defaults will be sufficient for most users. This
configurability potential will be a key to developing the
integrated monitoring capabilities of cfengine however.

<ul class="menu">
<li><a accesskey="1" href="#forgetrate-in-monitor">forgetrate in monitor</a>
<li><a accesskey="2" href="#monitorfacility-in-monitor">monitorfacility in monitor</a>
<li><a accesskey="3" href="#histograms-in-monitor">histograms in monitor</a>
<li><a accesskey="4" href="#tcpdump-in-monitor">tcpdump in monitor</a>
<li><a accesskey="5" href="#tcpdumpcommand-in-monitor">tcpdumpcommand in monitor</a>
</ul>

<div class="node">
<p><hr>
<a name="forgetrate-in-monitor"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#monitorfacility-in-monitor">monitorfacility in monitor</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#control-monitor">control monitor</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-monitor">control monitor</a>

</div>

<h4 class="subsection">5.4.1 <code>forgetrate</code></h4>

<p class="noindent"><b>Type</b>: real

<p class="noindent"><b>Allowed input range</b>: <code>0,1</code>

<p class="noindent"><b>Synopsis</b>: Decimal fraction [0,1] weighting of new values over old in 2d-average computation

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body monitor control
{
threshold => "0.3";
forgetrate => "0.7";
histograms => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Configurable settings for the machine-learning algorithm that
tracks system behaviour. This is only for expert users. This parameter
effectively determines (together with the monitoring rate) how
quickly cfengine forgets its previous history.

<div class="node">
<p><hr>
<a name="monitorfacility-in-monitor"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#histograms-in-monitor">histograms in monitor</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#forgetrate-in-monitor">forgetrate in monitor</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-monitor">control monitor</a>

</div>

<h4 class="subsection">5.4.2 <code>monitorfacility</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>LOG_USER</code>
               <code>LOG_DAEMON</code>
               <code>LOG_LOCAL0</code>
               <code>LOG_LOCAL1</code>
               <code>LOG_LOCAL2</code>
               <code>LOG_LOCAL3</code>
               <code>LOG_LOCAL4</code>
               <code>LOG_LOCAL5</code>
               <code>LOG_LOCAL6</code>
               <code>LOG_LOCAL7</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: Menu option for syslog facility

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body monitor control
{
monitorfacility => "LOG_USER";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>See notes for syslog.

<div class="node">
<p><hr>
<a name="histograms-in-monitor"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#tcpdump-in-monitor">tcpdump in monitor</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#monitorfacility-in-monitor">monitorfacility in monitor</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-monitor">control monitor</a>

</div>

<h4 class="subsection">5.4.3 <code>histograms</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false store signal histogram data

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body monitor control
{
histograms => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This is like the &lsquo;<samp><span class="samp">-H</span></samp>&rsquo; option to <code>cfenvd</code> in cfengine 2.  It
causes cfengine to learn the conformally transformed distributions of
fluctuations about the mean.

<div class="node">
<p><hr>
<a name="tcpdump-in-monitor"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#tcpdumpcommand-in-monitor">tcpdumpcommand in monitor</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#histograms-in-monitor">histograms in monitor</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-monitor">control monitor</a>

</div>

<h4 class="subsection">5.4.4 <code>tcpdump</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false use tcpdump if found

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body monitor control
{
tcpdump => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Interface with TCP stream if possible.

<div class="node">
<p><hr>
<a name="tcpdumpcommand-in-monitor"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#tcpdump-in-monitor">tcpdump in monitor</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-monitor">control monitor</a>

</div>

<h4 class="subsection">5.4.5 <code>tcpdumpcommand</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

<p class="noindent"><b>Synopsis</b>: Path to the tcpdump command on this system

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body monitor control
{
tcpdumpcommand => "/usr/sbin/tcpdump -i eth1";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If this is defined, the monitor will try to interface with the TCP stream and
monitor generic package categories for anomalies.

<div class="node">
<p><hr>
<a name="control-runagent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#control-executor">control executor</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#control-monitor">control monitor</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Control-Promises">Control Promises</a>

</div>

<h3 class="section">5.5 <code>runagent</code> control promises</h3>

<p><br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
     body runagent control
     {
     # default port is 5308
     
     hosts =&gt; { "127.0.0.1:5308", "eternity.iu.hio.no:80", "slogans.iu.hio.no" };
     
     #output_to_file =&gt; "true";
     }
     
</pre>
   </td></tr></table>

   <p><br>

   <p>The most important parameter here is the list of hosts that the agent
will poll for connections. This is easily read in from a file list,
however when doing so always have a stable input source that does not
depend on the network (including a database or directory service) in
any way: introducing such dependencies makes configuration brittle.

<ul class="menu">
<li><a accesskey="1" href="#hosts-in-runagent">hosts in runagent</a>
<li><a accesskey="2" href="#port-in-runagent">port in runagent</a>
<li><a accesskey="3" href="#force_005fipv4-in-runagent">force_ipv4 in runagent</a>
<li><a accesskey="4" href="#trustkey-in-runagent">trustkey in runagent</a>
<li><a accesskey="5" href="#encrypt-in-runagent">encrypt in runagent</a>
<li><a accesskey="6" href="#background_005fchildren-in-runagent">background_children in runagent</a>
<li><a accesskey="7" href="#max_005fchildren-in-runagent">max_children in runagent</a>
<li><a accesskey="8" href="#output_005fto_005ffile-in-runagent">output_to_file in runagent</a>
</ul>

<div class="node">
<p><hr>
<a name="hosts-in-runagent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#port-in-runagent">port in runagent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#control-runagent">control runagent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-runagent">control runagent</a>

</div>

<h4 class="subsection">5.5.1 <code>hosts</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: List of host or IP addresses to attempt connection with

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body runagent control
{
network1::
  hosts => { "host1.example.org", "host2", "host3" };

network2::
  hosts => { "host1.example.com", "host2", "host3" };
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The complete list of contactable hosts. The values may be either
numerical IP addresses or DNS names, optionally suffixed by a &lsquo;<samp><span class="samp">:</span></samp>&rsquo;
and a port number. If no port number is given, the default cfengine
port 5308 is assumed.

<div class="node">
<p><hr>
<a name="port-in-runagent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#force_005fipv4-in-runagent">force_ipv4 in runagent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#hosts-in-runagent">hosts in runagent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-runagent">control runagent</a>

</div>

<h4 class="subsection">5.5.2 <code>port</code></h4>

<p class="noindent"><b>Type</b>: int

<p class="noindent"><b>Allowed input range</b>: <code>1024,99999</code>

<p class="noindent"><b>Synopsis</b>: Default port for cfengine server

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body runagent control
{
port => "5308";
}

body server control
{
specialhost::
 port => "5308";

!specialhost::
 port => "5308";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The standard or registered port number is tcp/5308. Cfengine does not
presently use its registered udp port with the same number, but this
could change in the future.

   <p>Changing the standard port number is not recommended practice. You should
not do it without a good reason.

<div class="node">
<p><hr>
<a name="force_ipv4-in-runagent"></a>
<a name="force_005fipv4-in-runagent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#trustkey-in-runagent">trustkey in runagent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#port-in-runagent">port in runagent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-runagent">control runagent</a>

</div>

<h4 class="subsection">5.5.3 <code>force_ipv4</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false force use of ipv4 in connection

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body copy_from example
{
force_ipv4 => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>IPv6 should be harmless to most users unless you have a partially
or misconfigured setup.

<div class="node">
<p><hr>
<a name="trustkey-in-runagent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#encrypt-in-runagent">encrypt in runagent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#force_005fipv4-in-runagent">force_ipv4 in runagent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-runagent">control runagent</a>

</div>

<h4 class="subsection">5.5.4 <code>trustkey</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false automatically accept all keys on trust from servers

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body copy_from example
{
trustkey => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If the server's public key has not already been trusted, this
allows us to accept the key in automated key-exchange.

   <p>Note that, as a simple security precaution, trustkey should normally
be set to &lsquo;<samp><span class="samp">false</span></samp>&rsquo;, to avoid key exchange with a server one is not
one hundred percent sure about, though the risks for a client are
rather low. On the server-side however, trust is often granted to
many clients or to a whole network in which possibly unauthorized
parties might be able to obtain an IP address, thus the trust issue
is most important on the server side.

   <p>As soon as a public key has been exchanged, the trust option has no
effect. A machine that has been trusted remains trusted until
its key is manually revoked by a system administrator. Keys are
stored in <samp><span class="file">WORKDIR/ppkeys</span></samp>.

<div class="node">
<p><hr>
<a name="encrypt-in-runagent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#background_005fchildren-in-runagent">background_children in runagent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#trustkey-in-runagent">trustkey in runagent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-runagent">control runagent</a>

</div>

<h4 class="subsection">5.5.5 <code>encrypt</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false encrypt connections with servers

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body copy_from example
{
servers  => { "remote-host.example.org" };
encrypt => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Client connections are encrypted with using a Blowfish randomly
generated session key.  The intial connection is encrypted using the
public/private keys for the client and server hosts.

<div class="node">
<p><hr>
<a name="background_children-in-runagent"></a>
<a name="background_005fchildren-in-runagent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#max_005fchildren-in-runagent">max_children in runagent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#encrypt-in-runagent">encrypt in runagent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-runagent">control runagent</a>

</div>

<h4 class="subsection">5.5.6 <code>background_children</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false parallelize connections to servers

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body runagent control
{
background_children => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Causes the runagent to attempt parallelized connections to the servers.

<div class="node">
<p><hr>
<a name="max_children-in-runagent"></a>
<a name="max_005fchildren-in-runagent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#output_005fto_005ffile-in-runagent">output_to_file in runagent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#background_005fchildren-in-runagent">background_children in runagent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-runagent">control runagent</a>

</div>

<h4 class="subsection">5.5.7 <code>max_children</code></h4>

<p class="noindent"><b>Type</b>: int

<p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

<p class="noindent"><b>Synopsis</b>: Maximum number of simultaneous connections to attempt

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body runagent control
{
max_children => "10";
}

# or

body agent control
{
max_children => "10";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>For the run-agent this represents the maximum number of forked
background processes allowed when parallelizing connections to
servers. For the agent it represents the number of background jobs
allowed concurrently. Background jobs often lead to contention of
the disk resources slowing down tasks considerably; there is thus a law
of diminishing returns.

<div class="node">
<p><hr>
<a name="output_to_file-in-runagent"></a>
<a name="output_005fto_005ffile-in-runagent"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#max_005fchildren-in-runagent">max_children in runagent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-runagent">control runagent</a>

</div>

<h4 class="subsection">5.5.8 <code>output_to_file</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false whether to send collected output to file(s)

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body runagent control
{
output_to_file => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Filenames are chosen automatically and placed in the
<samp><span class="file">WORKDIR/outputs/</span><var>hostname</var><span class="file">_runagent.out</span></samp>.

<div class="node">
<p><hr>
<a name="control-executor"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#control-knowledge">control knowledge</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#control-runagent">control runagent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Control-Promises">Control Promises</a>

</div>

<h3 class="section">5.6 <code>executor</code> control promises</h3>

<p><br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
     body executor control
     
     {
     splaytime  =&gt; "5";
     mailto     =&gt; "cfengine@example.org";
     mailfrom   =&gt; "cfengine@$(host).example.org";
     smtpserver =&gt; "localhost";
     schedule   =&gt; { "Min00_05", "Min30_35" }
     }
     
</pre>
   </td></tr></table>

   <p><br>

   <p>These body settings determine the behaviour of <code>cf-execd</code>, including
scheduling times and output capture to <samp><span class="file">WORKDIR/outputs</span></samp> and relay via email. 
Note that the <code>splaytime</code> and <code>schedule</code> parameters
are now coded here rather than (as previously) in the agent.

<ul class="menu">
<li><a accesskey="1" href="#splaytime-in-executor">splaytime in executor</a>
<li><a accesskey="2" href="#mailfrom-in-executor">mailfrom in executor</a>
<li><a accesskey="3" href="#mailto-in-executor">mailto in executor</a>
<li><a accesskey="4" href="#smtpserver-in-executor">smtpserver in executor</a>
<li><a accesskey="5" href="#mailmaxlines-in-executor">mailmaxlines in executor</a>
<li><a accesskey="6" href="#schedule-in-executor">schedule in executor</a>
<li><a accesskey="7" href="#executorfacility-in-executor">executorfacility in executor</a>
<li><a accesskey="8" href="#exec_005fcommand-in-executor">exec_command in executor</a>
</ul>

<div class="node">
<p><hr>
<a name="splaytime-in-executor"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#mailfrom-in-executor">mailfrom in executor</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#control-executor">control executor</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-executor">control executor</a>

</div>

<h4 class="subsection">5.6.1 <code>splaytime</code></h4>

<p class="noindent"><b>Type</b>: int

<p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

<p class="noindent"><b>Synopsis</b>: Time in minutes to splay this host based on its name hash

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body executor control
{
splaytime => "2";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<p class="noindent">A rough rule of thumb for scaling of small updates is set the splay
time by:

   <p>splaytime = 1 + Number of clients / 50

<div class="node">
<p><hr>
<a name="mailfrom-in-executor"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#mailto-in-executor">mailto in executor</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#splaytime-in-executor">splaytime in executor</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-executor">control executor</a>

</div>

<h4 class="subsection">5.6.2 <code>mailfrom</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>.*.*</code>

<p class="noindent"><b>Synopsis</b>: Email-address cfengine mail appears to come from

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body executor control
{
mailfrom => "MrCfengine@example.org";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="mailto-in-executor"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#smtpserver-in-executor">smtpserver in executor</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#mailfrom-in-executor">mailfrom in executor</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-executor">control executor</a>

</div>

<h4 class="subsection">5.6.3 <code>mailto</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>.*.*</code>

<p class="noindent"><b>Synopsis</b>: Email-address cfengine mail is sent to

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body executor control
{
mailto => "cfengine_alias@example.org";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The address to whom email is sent if an smtp host is configured.

<div class="node">
<p><hr>
<a name="smtpserver-in-executor"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#mailmaxlines-in-executor">mailmaxlines in executor</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#mailto-in-executor">mailto in executor</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-executor">control executor</a>

</div>

<h4 class="subsection">5.6.4 <code>smtpserver</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>.*</code>

<p class="noindent"><b>Synopsis</b>: Name or IP of a willing smtp server for sending email

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body executor control
{
smtpserver => "smtp.example.org";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This should point to a standard port 25 server without encyption. 
If you are running secured or encrypted email then you should
run a mail relay on localhost and point this to localhost.

<div class="node">
<p><hr>
<a name="mailmaxlines-in-executor"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#schedule-in-executor">schedule in executor</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#smtpserver-in-executor">smtpserver in executor</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-executor">control executor</a>

</div>

<h4 class="subsection">5.6.5 <code>mailmaxlines</code></h4>

<p class="noindent"><b>Type</b>: int

<p class="noindent"><b>Allowed input range</b>: <code>0,1000</code>

<p class="noindent"><b>Synopsis</b>: Maximum number of lines of output to send by email

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body executor control
{
mailmaxlines => "100";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This limit prevents anomalously large outputs from clogging up a
system administrator's mailbox.  The output is truncated in the email
report, but the complete original transcript is stored in
<samp><span class="file">WORKDIR/outputs/*</span></samp> where it can be viewed on demand. 
A reference to the appropriate file is given.

<div class="node">
<p><hr>
<a name="schedule-in-executor"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#executorfacility-in-executor">executorfacility in executor</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#mailmaxlines-in-executor">mailmaxlines in executor</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-executor">control executor</a>

</div>

<h4 class="subsection">5.6.6 <code>schedule</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: The class schedule for activating cf-execd

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body executor control
{
schedule => { "Min00_05", "Min05_20", "Min30_35", "Min45_50" };
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The list should contain classes which are visible to the <code>cf-execd</code>
daemon. In principle any defined class will cause the daemon to wake up
and schedule the execution of the <code>cf-agent</code>.

<div class="node">
<p><hr>
<a name="executorfacility-in-executor"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#exec_005fcommand-in-executor">exec_command in executor</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#schedule-in-executor">schedule in executor</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-executor">control executor</a>

</div>

<h4 class="subsection">5.6.7 <code>executorfacility</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>LOG_USER</code>
               <code>LOG_DAEMON</code>
               <code>LOG_LOCAL0</code>
               <code>LOG_LOCAL1</code>
               <code>LOG_LOCAL2</code>
               <code>LOG_LOCAL3</code>
               <code>LOG_LOCAL4</code>
               <code>LOG_LOCAL5</code>
               <code>LOG_LOCAL6</code>
               <code>LOG_LOCAL7</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: Menu option for syslog facility level

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body executor control
{
executorfacility => "LOG_USER";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>See the syslog manual pages.

<div class="node">
<p><hr>
<a name="exec_command-in-executor"></a>
<a name="exec_005fcommand-in-executor"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#executorfacility-in-executor">executorfacility in executor</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-executor">control executor</a>

</div>

<h4 class="subsection">5.6.8 <code>exec_command</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

<p class="noindent"><b>Synopsis</b>: The full path and command to the executable run by default (overriding builtin)

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
exec_command => "$(sys.workdir)/bin/cf-agent -f failsafe.cf &amp;&amp; $(sys.workdir)/bin/cf-agent";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The command is run in a shell encapsulation so pipes and shell symbols
may be used if desired.  Unlike, cfengine 2, cfengine 3 does not
automatically run a separate update sequence before its normal
run. This can be handled using the approach in the example above.

<div class="node">
<p><hr>
<a name="control-knowledge"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#control-reporter">control reporter</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#control-executor">control executor</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Control-Promises">Control Promises</a>

</div>

<h3 class="section">5.7 <code>knowledge</code> control promises</h3>

<p><br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
     body knowledge control
     
     {
     build_directory =&gt; ".";
     
     sql_database =&gt; "my_knowledge";
     sql_owner =&gt; "db_user";
     sql_passwd =&gt; ""; # No passwd
     sql_type =&gt; "mysql";
     
     query_output =&gt; "html";
     
     style_sheet =&gt; "http://www.example.org/css/style.css";
     html_banner =&gt;
                    "
                    &lt;ul&gt;
                     &lt;li&gt;Item 1
                     &lt;li&gt;Item 2
                    &lt;/ul&gt;
                    ";
     }
     
</pre>
   </td></tr></table>

   <p><br>

   <p>These parameters control the way in which knowledge data are stored
and retrieved from a relational database and the output format
of the queries.

<ul class="menu">
<li><a accesskey="1" href="#id_005fprefix-in-knowledge">id_prefix in knowledge</a>
<li><a accesskey="2" href="#build_005fdirectory-in-knowledge">build_directory in knowledge</a>
<li><a accesskey="3" href="#sql_005ftype-in-knowledge">sql_type in knowledge</a>
<li><a accesskey="4" href="#sql_005fdatabase-in-knowledge">sql_database in knowledge</a>
<li><a accesskey="5" href="#sql_005fowner-in-knowledge">sql_owner in knowledge</a>
<li><a accesskey="6" href="#sql_005fpasswd-in-knowledge">sql_passwd in knowledge</a>
<li><a accesskey="7" href="#sql_005fserver-in-knowledge">sql_server in knowledge</a>
<li><a accesskey="8" href="#sql_005fconnection_005fdb-in-knowledge">sql_connection_db in knowledge</a>
<li><a accesskey="9" href="#query_005foutput-in-knowledge">query_output in knowledge</a>
<li><a href="#query_005fengine-in-knowledge">query_engine in knowledge</a>
<li><a href="#style_005fsheet-in-knowledge">style_sheet in knowledge</a>
<li><a href="#html_005fbanner-in-knowledge">html_banner in knowledge</a>
<li><a href="#html_005ffooter-in-knowledge">html_footer in knowledge</a>
<li><a href="#graph_005foutput-in-knowledge">graph_output in knowledge</a>
<li><a href="#graph_005fdirectory-in-knowledge">graph_directory in knowledge</a>
<li><a href="#generate_005fmanual-in-knowledge">generate_manual in knowledge</a>
<li><a href="#manual_005fsource_005fdirectory-in-knowledge">manual_source_directory in knowledge</a>
</ul>

<div class="node">
<p><hr>
<a name="id_prefix-in-knowledge"></a>
<a name="id_005fprefix-in-knowledge"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#build_005fdirectory-in-knowledge">build_directory in knowledge</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#control-knowledge">control knowledge</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-knowledge">control knowledge</a>

</div>

<h4 class="subsection">5.7.1 <code>id_prefix</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>.*</code>

<p class="noindent"><b>Synopsis</b>: The LTM identifier prefix used to label topic maps (used for disambiguation in merging)

<p class="noindent"><b>Example</b>:<br>
<br>
<pre class="verbatim">
body knowledge control
{
id_prefix => "unique_prefix";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Use to disambiguate indentifiers for a successful merging of topic maps,
especially in Linear Topic Map (LTM) format using third party tools such
as Ontopia's Omnigator.

<div class="node">
<p><hr>
<a name="build_directory-in-knowledge"></a>
<a name="build_005fdirectory-in-knowledge"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#sql_005ftype-in-knowledge">sql_type in knowledge</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#id_005fprefix-in-knowledge">id_prefix in knowledge</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-knowledge">control knowledge</a>

</div>

<h4 class="subsection">5.7.2 <code>build_directory</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>.*</code>

<p class="noindent"><b>Synopsis</b>: The directory in which to generate output files

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body knowledge control

{
#..
build_directory => "/tmp/builddir";
}

body reporter control

{
#..
build_directory => "/tmp/builddir";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The directory where all auto-generated textual output is placed by <code>cf-know</code>. 
This includes manual generation, ontology and topic map data.

<div class="node">
<p><hr>
<a name="sql_type-in-knowledge"></a>
<a name="sql_005ftype-in-knowledge"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#sql_005fdatabase-in-knowledge">sql_database in knowledge</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#build_005fdirectory-in-knowledge">build_directory in knowledge</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-knowledge">control knowledge</a>

</div>

<h4 class="subsection">5.7.3 <code>sql_type</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>mysql</code>
               <code>postgres</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: Menu option for supported database type

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body knowledge control
{
sql_type => "mysql";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="sql_database-in-knowledge"></a>
<a name="sql_005fdatabase-in-knowledge"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#sql_005fowner-in-knowledge">sql_owner in knowledge</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#sql_005ftype-in-knowledge">sql_type in knowledge</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-knowledge">control knowledge</a>

</div>

<h4 class="subsection">5.7.4 <code>sql_database</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: Name of database used for the topic map

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body knowledge control
{
sql_database => "cfengine_knowledge_db";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The name of an SQL database for caching knowledge.

<div class="node">
<p><hr>
<a name="sql_owner-in-knowledge"></a>
<a name="sql_005fowner-in-knowledge"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#sql_005fpasswd-in-knowledge">sql_passwd in knowledge</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#sql_005fdatabase-in-knowledge">sql_database in knowledge</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-knowledge">control knowledge</a>

</div>

<h4 class="subsection">5.7.5 <code>sql_owner</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: User id of sql database user

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body knowledge control
{
sql_owner => "db_owner";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Part of the credentials for opening the database. This depends on the type of
database.

<div class="node">
<p><hr>
<a name="sql_passwd-in-knowledge"></a>
<a name="sql_005fpasswd-in-knowledge"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#sql_005fserver-in-knowledge">sql_server in knowledge</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#sql_005fowner-in-knowledge">sql_owner in knowledge</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-knowledge">control knowledge</a>

</div>

<h4 class="subsection">5.7.6 <code>sql_passwd</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: Embedded password for accessing sql database

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body knowledge control
{
sql_passwd => "";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Part of the credentials for connecting to the database server. 
This is system dependent. If the server host is localhost a password
might not be required.

<div class="node">
<p><hr>
<a name="sql_server-in-knowledge"></a>
<a name="sql_005fserver-in-knowledge"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#sql_005fconnection_005fdb-in-knowledge">sql_connection_db in knowledge</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#sql_005fpasswd-in-knowledge">sql_passwd in knowledge</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-knowledge">control knowledge</a>

</div>

<h4 class="subsection">5.7.7 <code>sql_server</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: Name or IP of database server (or localhost)

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body knowledge control
{
sql_server => "localhost";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The host name of IP address of the server. The default is to look on the localhost.

<div class="node">
<p><hr>
<a name="sql_connection_db-in-knowledge"></a>
<a name="sql_005fconnection_005fdb-in-knowledge"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#query_005foutput-in-knowledge">query_output in knowledge</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#sql_005fserver-in-knowledge">sql_server in knowledge</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-knowledge">control knowledge</a>

</div>

<h4 class="subsection">5.7.8 <code>sql_connection_db</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: The name of an existing database to connect to in order to create/manage other databases

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body knowledge control
{
sql_connection_db => "mysql";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>In order to create a database on a database server (all of which
practice voluntary cooperation), one has to be able to connect
to the server, however, without an existing database this is not allowed. 
Thus, database servers provide a default database that can be connected
to in order to thereafter create new databases. These are called
<code>postgres</code> and <code>mysql</code> for their respective database servers.

   <p>For the knowledge agent, this setting is made in the control body,
for database verification promises, it is made in the
<code>database_server</code> body.

<div class="node">
<p><hr>
<a name="query_output-in-knowledge"></a>
<a name="query_005foutput-in-knowledge"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#query_005fengine-in-knowledge">query_engine in knowledge</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#sql_005fconnection_005fdb-in-knowledge">sql_connection_db in knowledge</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-knowledge">control knowledge</a>

</div>

<h4 class="subsection">5.7.9 <code>query_output</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>html</code>
               <code>text</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: Menu option for generated output format

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body knowledge control
{
query_output => "html";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="query_engine-in-knowledge"></a>
<a name="query_005fengine-in-knowledge"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#style_005fsheet-in-knowledge">style_sheet in knowledge</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#query_005foutput-in-knowledge">query_output in knowledge</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-knowledge">control knowledge</a>

</div>

<h4 class="subsection">5.7.10 <code>query_engine</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: Name of a dynamic web-page used to accept and drive queries in a browser

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body knowledge control
{
query_engine => "http://www.example.org/script.php";
}

body reporter control
{
query_engine => "http://www.example.org/script.pl";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>When displaying topic maps in HTML format, <code>cf-know</code> will render
each topic as a link to this URL with the new topic as an argument. 
Thus it is possible to make a dynamic web query by embedding cfengine
in the web page as system call and passing the argument to it.

<div class="node">
<p><hr>
<a name="style_sheet-in-knowledge"></a>
<a name="style_005fsheet-in-knowledge"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#html_005fbanner-in-knowledge">html_banner in knowledge</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#query_005fengine-in-knowledge">query_engine in knowledge</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-knowledge">control knowledge</a>

</div>

<h4 class="subsection">5.7.11 <code>style_sheet</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: Name of a style-sheet to be used in rendering html output (added to headers)

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body knowledge control
{
style_sheet => "http://www.example.org/css/sheet.css";
}

body reporter control
{
style_sheet => "http://www.example.org/css/sheet.css";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>For formatting the HTML generated output of <code>cf-know</code>.

<div class="node">
<p><hr>
<a name="html_banner-in-knowledge"></a>
<a name="html_005fbanner-in-knowledge"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#html_005ffooter-in-knowledge">html_footer in knowledge</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#style_005fsheet-in-knowledge">style_sheet in knowledge</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-knowledge">control knowledge</a>

</div>

<h4 class="subsection">5.7.12 <code>html_banner</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: HTML code for a banner to be added to rendered in html after the header

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body knowledge control
{
html_banner => "&lt;img src=\"http://www.example.org/img/banner.png\">";
}

body reporter control
{
html_banner => "&lt;img src=\"http://www.example.org/img/banner.png\">";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This content is cited when generating HTML output from the knowledge agent.

<div class="node">
<p><hr>
<a name="html_footer-in-knowledge"></a>
<a name="html_005ffooter-in-knowledge"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#graph_005foutput-in-knowledge">graph_output in knowledge</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#html_005fbanner-in-knowledge">html_banner in knowledge</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-knowledge">control knowledge</a>

</div>

<h4 class="subsection">5.7.13 <code>html_footer</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: HTML code for a page footer to be added to rendered in html before the end body tag

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body reporter control
{
html_footer => "
               &lt;div id=\"footer\">Bottom of the page&lt;/div>
               ";
}

body knowledge control
{
html_footer => "
               &lt;div id=\"footer\">Bottom of the page&lt;/div>
               ";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This allows us to cite HTML code for formatting reports generated by the reporting and knowledge
agents.

<div class="node">
<p><hr>
<a name="graph_output-in-knowledge"></a>
<a name="graph_005foutput-in-knowledge"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#graph_005fdirectory-in-knowledge">graph_directory in knowledge</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#html_005ffooter-in-knowledge">html_footer in knowledge</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-knowledge">control knowledge</a>

</div>

<h4 class="subsection">5.7.14 <code>graph_output</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false generate png visualization of topic map if possible (requires lib)

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">body knowledge control

{
# fix/override -g option
graph_output => "true"; 
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Equivalent to the use of the &lsquo;<samp><span class="samp">-g</span></samp>&rsquo; option for <code>cf-know</code>.

<div class="node">
<p><hr>
<a name="graph_directory-in-knowledge"></a>
<a name="graph_005fdirectory-in-knowledge"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#generate_005fmanual-in-knowledge">generate_manual in knowledge</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#graph_005foutput-in-knowledge">graph_output in knowledge</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-knowledge">control knowledge</a>

</div>

<h4 class="subsection">5.7.15 <code>graph_directory</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

<p class="noindent"><b>Synopsis</b>: Path to directory where rendered .png files will be created

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body knowledge control
{
graph_directory => "/tmp/output";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>A separate location where the potentially large number of <samp><span class="file">.png</span></samp>
visualizations of a knowledge representation are pre-compiled. 
This feature only works if the necessary graphics libraries are
present.

<div class="node">
<p><hr>
<a name="generate_manual-in-knowledge"></a>
<a name="generate_005fmanual-in-knowledge"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#manual_005fsource_005fdirectory-in-knowledge">manual_source_directory in knowledge</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#graph_005fdirectory-in-knowledge">graph_directory in knowledge</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-knowledge">control knowledge</a>

</div>

<h4 class="subsection">5.7.16 <code>generate_manual</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false generate texinfo manual page skeleton for this version

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body knowledge control
{
generate_manual => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Auto-creates a manual based on the self-documented code. As the
promise syntax is extended the manual self-heals. The resulting manual
is generated in Texinfo format, from which all other formats can be
generated.

<div class="node">
<p><hr>
<a name="manual_source_directory-in-knowledge"></a>
<a name="manual_005fsource_005fdirectory-in-knowledge"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#generate_005fmanual-in-knowledge">generate_manual in knowledge</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-knowledge">control knowledge</a>

</div>

<h4 class="subsection">5.7.17 <code>manual_source_directory</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

<p class="noindent"><b>Synopsis</b>: Path to directory where raw text about manual topics is found (defaults to build_directory)

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body knowledge control
{
manual_source => "/path/cfengine_manual_commentary";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This is used in the self-healing documentation. The directory points to
a location where the Texinfo sources for per-section commentary is maintained.

<div class="node">
<p><hr>
<a name="control-reporter"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#control-knowledge">control knowledge</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Control-Promises">Control Promises</a>

</div>

<h3 class="section">5.8 <code>reporter</code> control promises</h3>

<p><br>

<pre class="verbatim">
body reporter control
{
reports => { "performance", "last_seen", "monitor_history" };
build_directory => "/tmp/nerves";
report_output => "html";
}

</pre>

   <p><br>

   <p>Determines a list of reports to write into the build directory. The
format may be in text, html or xml format. The reporter agent
<code>cf-report</code> replaces both <code>cfshow</code> and <code>cfenvgraph</code>. It
no longer produces output to the console.

   <p>Some reports are only available in enterprise level versions of cfengine.

<ul class="menu">
<li><a accesskey="1" href="#aggregation_005fpoint-in-reporter">aggregation_point in reporter</a>
<li><a accesskey="2" href="#auto_005fscaling-in-reporter">auto_scaling in reporter</a>
<li><a accesskey="3" href="#build_005fdirectory-in-reporter">build_directory in reporter</a>
<li><a accesskey="4" href="#csv2xml-in-reporter">csv2xml in reporter</a>
<li><a accesskey="5" href="#error_005fbars-in-reporter">error_bars in reporter</a>
<li><a accesskey="6" href="#html_005fbanner-in-reporter">html_banner in reporter</a>
<li><a accesskey="7" href="#html_005fembed-in-reporter">html_embed in reporter</a>
<li><a accesskey="8" href="#html_005ffooter-in-reporter">html_footer in reporter</a>
<li><a accesskey="9" href="#query_005fengine-in-reporter">query_engine in reporter</a>
<li><a href="#reports-in-reporter">reports in reporter</a>
<li><a href="#report_005foutput-in-reporter">report_output in reporter</a>
<li><a href="#style_005fsheet-in-reporter">style_sheet in reporter</a>
<li><a href="#time_005fstamps-in-reporter">time_stamps in reporter</a>
</ul>

<div class="node">
<p><hr>
<a name="aggregation_point-in-reporter"></a>
<a name="aggregation_005fpoint-in-reporter"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#auto_005fscaling-in-reporter">auto_scaling in reporter</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#control-reporter">control reporter</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-reporter">control reporter</a>

</div>

<h4 class="subsection">5.8.1 <code>aggregation_point</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

<p class="noindent"><b>Synopsis</b>: The root directory of the data cache for CMDB aggregation

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body reporter control
{
aggregation_point => "/srv/www/htdocs/reports";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This feature is only used in enterprise level versions of cfengine. 
It specifies the directory where reports from multiple hosts are
to be aggregated in sub-directories. This should be somewhere under
the document root of the web server for the cfengine knowledge base
in order to make the reports browsable.

<div class="node">
<p><hr>
<a name="auto_scaling-in-reporter"></a>
<a name="auto_005fscaling-in-reporter"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#build_005fdirectory-in-reporter">build_directory in reporter</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#aggregation_005fpoint-in-reporter">aggregation_point in reporter</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-reporter">control reporter</a>

</div>

<h4 class="subsection">5.8.2 <code>auto_scaling</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false whether to auto-scale graph output to optimize use of space

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body reporter control
{
auto_scaling => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Automatic scaling is the default.

<div class="node">
<p><hr>
<a name="build_directory-in-reporter"></a>
<a name="build_005fdirectory-in-reporter"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#csv2xml-in-reporter">csv2xml in reporter</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#auto_005fscaling-in-reporter">auto_scaling in reporter</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-reporter">control reporter</a>

</div>

<h4 class="subsection">5.8.3 <code>build_directory</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>.*</code>

<p class="noindent"><b>Synopsis</b>: The directory in which to generate output files

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body knowledge control

{
#..
build_directory => "/tmp/builddir";
}

body reporter control

{
#..
build_directory => "/tmp/builddir";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The directory where all auto-generated textual output is placed by <code>cf-know</code>. 
This includes manual generation, ontology and topic map data.

<div class="node">
<p><hr>
<a name="csv2xml-in-reporter"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#error_005fbars-in-reporter">error_bars in reporter</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#build_005fdirectory-in-reporter">build_directory in reporter</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-reporter">control reporter</a>

</div>

<h4 class="subsection">5.8.4 <code>csv2xml</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: A list of csv formatted files in the build directory to convert to simple xml

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body reporter control
{
csv2xml => { "myreport.csv", "custom_report.csv"  };
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>CSV files are easy to generate in cfengine from individual promise logging functions. 
XML is not easily generated due to its hierarchical structure. This function allows
<code>cf-report</code> to convert a CSV file into pidgin XML for convenience. The schema
has the general form:

<pre class="verbatim">
&lt;output>
 &lt;line> &lt;one>...&lt;/one> &lt;two>...&lt;/two> ... &lt;/line>
 &lt;line> &lt;one>...&lt;/one> &lt;two>...&lt;/two> ... &lt;/line>
&lt;/output>

</pre>

<div class="node">
<p><hr>
<a name="error_bars-in-reporter"></a>
<a name="error_005fbars-in-reporter"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#html_005fbanner-in-reporter">html_banner in reporter</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#csv2xml-in-reporter">csv2xml in reporter</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-reporter">control reporter</a>

</div>

<h4 class="subsection">5.8.5 <code>error_bars</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false whether to generate error bars on graph output

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body reporter control
{
error_bars => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The default is to produce error bars. Without error bars from
cfengine's machine learning data there is no way to assess
the significance of an observation about the system, i.e. whether
it is normal or anomalous.

<div class="node">
<p><hr>
<a name="html_banner-in-reporter"></a>
<a name="html_005fbanner-in-reporter"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#html_005fembed-in-reporter">html_embed in reporter</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#error_005fbars-in-reporter">error_bars in reporter</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-reporter">control reporter</a>

</div>

<h4 class="subsection">5.8.6 <code>html_banner</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: HTML code for a banner to be added to rendered in html after the header

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body knowledge control
{
html_banner => "&lt;img src=\"http://www.example.org/img/banner.png\">";
}

body reporter control
{
html_banner => "&lt;img src=\"http://www.example.org/img/banner.png\">";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This content is cited when generating HTML output from the knowledge agent.

<div class="node">
<p><hr>
<a name="html_embed-in-reporter"></a>
<a name="html_005fembed-in-reporter"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#html_005ffooter-in-reporter">html_footer in reporter</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#html_005fbanner-in-reporter">html_banner in reporter</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-reporter">control reporter</a>

</div>

<h4 class="subsection">5.8.7 <code>html_embed</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: If true, no header and footer tags will be added to html output

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body reporter control
{
html_embed => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Embedded HTML means something that could be put into a frame or table, without
html or body tags, headers footers etc.

<div class="node">
<p><hr>
<a name="html_footer-in-reporter"></a>
<a name="html_005ffooter-in-reporter"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#query_005fengine-in-reporter">query_engine in reporter</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#html_005fembed-in-reporter">html_embed in reporter</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-reporter">control reporter</a>

</div>

<h4 class="subsection">5.8.8 <code>html_footer</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: HTML code for a page footer to be added to rendered in html before the end body tag

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body reporter control
{
html_footer => "
               &lt;div id=\"footer\">Bottom of the page&lt;/div>
               ";
}

body knowledge control
{
html_footer => "
               &lt;div id=\"footer\">Bottom of the page&lt;/div>
               ";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This allows us to cite HTML code for formatting reports generated by the reporting and knowledge
agents.

<div class="node">
<p><hr>
<a name="query_engine-in-reporter"></a>
<a name="query_005fengine-in-reporter"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#reports-in-reporter">reports in reporter</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#html_005ffooter-in-reporter">html_footer in reporter</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-reporter">control reporter</a>

</div>

<h4 class="subsection">5.8.9 <code>query_engine</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: Name of a dynamic web-page used to accept and drive queries in a browser

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body knowledge control
{
query_engine => "http://www.example.org/script.php";
}

body reporter control
{
query_engine => "http://www.example.org/script.pl";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>When displaying topic maps in HTML format, <code>cf-know</code> will render
each topic as a link to this URL with the new topic as an argument. 
Thus it is possible to make a dynamic web query by embedding cfengine
in the web page as system call and passing the argument to it.

<div class="node">
<p><hr>
<a name="reports-in-reporter"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#report_005foutput-in-reporter">report_output in reporter</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#query_005fengine-in-reporter">query_engine in reporter</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-reporter">control reporter</a>

</div>

<h4 class="subsection">5.8.10 <code>reports</code></h4>

<p class="noindent"><b>Type</b>: (option list)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>audit</code>
               <code>performance</code>
               <code>all_locks</code>
               <code>active_locks</code>
               <code>hashes</code>
               <code>classes</code>
               <code>last_seen</code>
               <code>monitor_now</code>
               <code>monitor_history</code>
               <code>monitor_summary</code>
               <code>compliance</code>
               <code>setuid</code>
               <code>file_changes</code>
               <code>installed_software</code>
               <code>software_patches</code>
               <code>variables</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: A list of reports that may be generated

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body reporter control
{
reports => { "performance", "classes"  };
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>A list of report types that can be generated by this agent.  The
listed items from <code>compliance</code> onward are available only
Enterprise editions of cfengine.

<div class="node">
<p><hr>
<a name="report_output-in-reporter"></a>
<a name="report_005foutput-in-reporter"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#style_005fsheet-in-reporter">style_sheet in reporter</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#reports-in-reporter">reports in reporter</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-reporter">control reporter</a>

</div>

<h4 class="subsection">5.8.11 <code>report_output</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>csv</code>
               <code>html</code>
               <code>text</code>
               <code>xml</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: Menu option for generated output format. Applies only to text reports, graph data remain in xydy format.

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body reporter control
{
report_output => "html";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Sets the output format of embedded database reports.

<div class="node">
<p><hr>
<a name="style_sheet-in-reporter"></a>
<a name="style_005fsheet-in-reporter"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#time_005fstamps-in-reporter">time_stamps in reporter</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#report_005foutput-in-reporter">report_output in reporter</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-reporter">control reporter</a>

</div>

<h4 class="subsection">5.8.12 <code>style_sheet</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: Name of a style-sheet to be used in rendering html output (added to headers)

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body knowledge control
{
style_sheet => "http://www.example.org/css/sheet.css";
}

body reporter control
{
style_sheet => "http://www.example.org/css/sheet.css";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>For formatting the HTML generated output of <code>cf-know</code>.

<div class="node">
<p><hr>
<a name="time_stamps-in-reporter"></a>
<a name="time_005fstamps-in-reporter"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#style_005fsheet-in-reporter">style_sheet in reporter</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#control-reporter">control reporter</a>

</div>

<h4 class="subsection">5.8.13 <code>time_stamps</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false whether to generate timestamps on the output directory

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body reporter control
{
time_stamps => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This option is only necessary with the default build directory.  This
can be used to keep snapshots of the system but it will result in a
lot of storage be consumed. For most purposes cfengine is programmed
to forget the past at a predictable rate and there is no need to
override this.

<!-- ***************************************************** -->
<!-- * CHAPTER -->
<!-- ***************************************************** -->
<div class="node">
<p><hr>
<a name="Bundles-for-common"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Bundles-for-agent">Bundles for agent</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Control-Promises">Control Promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Top">Top</a>

</div>

<h2 class="chapter">6 Bundles of <code>common</code></h2>

<p><br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
     bundle common globals
     {
     vars:
     
       "global_var" string =&gt; "value";
     
     classes:
     
       "global_class" expression =&gt; "value";
     }
     
</pre>
   </td></tr></table>

   <p><br>

   <p>Common bundles may only contain the promise types that are common to
all bodies.  Their main function is to define cross-component global
definitions. Common bundles are observed by every agent, whereas the
agent specific bundle types are ignored by components other than the
intended recipient.

<ul class="menu">
<li><a accesskey="1" href="#vars-in-common-promises">vars in common promises</a>
<li><a accesskey="2" href="#classes-in-common-promises">classes in common promises</a>
<li><a accesskey="3" href="#reports-in-common-promises">reports in common promises</a>
<li><a accesskey="4" href="#g_t_002a-in-agent-promises">* in agent promises</a>
<li><a accesskey="5" href="#g_t_002a-in-edit_005fline-promises">* in edit_line promises</a>
</ul>

<div class="node">
<p><hr>
<a name="vars-in-common-promises"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#classes-in-common-promises">classes in common promises</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Bundles-for-common">Bundles for common</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-common">Bundles for common</a>

</div>

<h3 class="section">6.1 <code>vars</code> promises</h3>

<p><br>

   <p>Whereas most promise types are specific to a particular kind of
interpretation that requires a typed interpreter (the bundle type),
a number of promises can be made in any kind of bundle since they
are of a generic input/output nature. These are listed below.

<ul class="menu">
<li><a accesskey="1" href="#string-in-vars">string in vars</a>
<li><a accesskey="2" href="#int-in-vars">int in vars</a>
<li><a accesskey="3" href="#real-in-vars">real in vars</a>
<li><a accesskey="4" href="#slist-in-vars">slist in vars</a>
<li><a accesskey="5" href="#ilist-in-vars">ilist in vars</a>
<li><a accesskey="6" href="#rlist-in-vars">rlist in vars</a>
<li><a accesskey="7" href="#policy-in-vars">policy in vars</a>
</ul>

<div class="node">
<p><hr>
<a name="string-in-vars"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#int-in-vars">int in vars</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#vars-in-common-promises">vars in common promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#vars-in-common-promises">vars in common promises</a>

</div>

<h4 class="subsection">6.1.1 <code>string</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: A scalar string

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
vars:

 "xxx"    string => "Some literal string...";

 "yyy"    string => readfile( "/home/mark/tmp/testfile" , "33" );

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>In cfengine previously lists were represented (as in the shell) using
separted scalars, e.g. like the PATH variable. This design feature
turned out to be an error of judgement which has resulted in much
trouble. This is no longer supported in cfengine 3. By keeping lists
an independent type many limitations have been removed.

<div class="node">
<p><hr>
<a name="int-in-vars"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#real-in-vars">real in vars</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#string-in-vars">string in vars</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#vars-in-common-promises">vars in common promises</a>

</div>

<h4 class="subsection">6.1.2 <code>int</code></h4>

<p class="noindent"><b>Type</b>: int

<p class="noindent"><b>Allowed input range</b>: <code>-99999999999,9999999999</code>

<p class="noindent"><b>Synopsis</b>: A scalar integer

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">vars:

 "scalar" int    => "16k";

 "ran"    int    => randomint(4,88);

 "dim_array" int =>  readstringarray("array_name","/etc/passwd","#[^\n]*",":",10,4000);

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Integer values may use suffices &lsquo;<samp><span class="samp">k</span></samp>&rsquo;, &lsquo;<samp><span class="samp">K</span></samp>&rsquo;, &lsquo;<samp><span class="samp">m</span></samp>&rsquo;, &lsquo;<samp><span class="samp">M</span></samp>&rsquo;, etc

     <dl>
<dt>&lsquo;<samp><span class="samp">k</span></samp>&rsquo;<dd>The value multipled by 1000. 
<br><dt>&lsquo;<samp><span class="samp">K</span></samp>&rsquo;<dd>The value multipled by 1024. 
<br><dt>&lsquo;<samp><span class="samp">m</span></samp>&rsquo;<dd>The value multipled by 1000 * 1000. 
<br><dt>&lsquo;<samp><span class="samp">M</span></samp>&rsquo;<dd>The value multipled by 1024 * 1024. 
<br><dt>&lsquo;<samp><span class="samp">g</span></samp>&rsquo;<dd>The value multipled by 1000 * 1000 * 1000. 
<br><dt>&lsquo;<samp><span class="samp">G</span></samp>&rsquo;<dd>The value multipled by 1024 * 1024 * 1024. 
<br><dt>&lsquo;<samp><span class="samp">%</span></samp>&rsquo;<dd>A percentage between 1 and 100 - mainly for use in a storage context.

   </dl>

   <p>The value &lsquo;<samp><span class="samp">inf</span></samp>&rsquo; may also be used to represent an umlimited positive value.

<div class="node">
<p><hr>
<a name="real-in-vars"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#slist-in-vars">slist in vars</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#int-in-vars">int in vars</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#vars-in-common-promises">vars in common promises</a>

</div>

<h4 class="subsection">6.1.3 <code>real</code></h4>

<p class="noindent"><b>Type</b>: real

<p class="noindent"><b>Allowed input range</b>: <code>-9.99999E100,9.99999E100</code>

<p class="noindent"><b>Synopsis</b>: A scalar real number

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
vars:
   
 "scalar" real   => "0.5";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Real numbers are not used in many places in cfengine, but they are
useful for representing probabilties and performance data.

<div class="node">
<p><hr>
<a name="slist-in-vars"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#ilist-in-vars">ilist in vars</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#real-in-vars">real in vars</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#vars-in-common-promises">vars in common promises</a>

</div>

<h4 class="subsection">6.1.4 <code>slist</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: A list of scalar strings

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">vars:

 "xxx"    slist  => {  "literal1",  "literal2" };

 "yyy"    slist  => { 
                    readstringlist(
                                  "/home/mark/tmp/testlist",
                                  "#[a-zA-Z0-9 ]*",
                                  "[^a-zA-Z0-9]",
                                  15,
                                  4000
                                  ) 
                    };

 "zzz"    slist  => { readstringlist("/home/mark/tmp/testlist2","#[^\n]*",",",5,4000) };


</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="ilist-in-vars"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#rlist-in-vars">rlist in vars</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#slist-in-vars">slist in vars</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#vars-in-common-promises">vars in common promises</a>

</div>

<h4 class="subsection">6.1.5 <code>ilist</code></h4>

<p class="noindent"><b>Type</b>: ilist

<p class="noindent"><b>Allowed input range</b>: <code>-99999999999,9999999999</code>

<p class="noindent"><b>Synopsis</b>: A list of integers

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
vars:

  "variable_id"

       ilist => { "10", "11", "12" };

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Integer lists are lists of strings that are expected to be treated as integers. 
The typing in cfengine is dynamic, so the variable types are interchangable.

<div class="node">
<p><hr>
<a name="rlist-in-vars"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#policy-in-vars">policy in vars</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#ilist-in-vars">ilist in vars</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#vars-in-common-promises">vars in common promises</a>

</div>

<h4 class="subsection">6.1.6 <code>rlist</code></h4>

<p class="noindent"><b>Type</b>: rlist

<p class="noindent"><b>Allowed input range</b>: <code>-9.99999E100,9.99999E100</code>

<p class="noindent"><b>Synopsis</b>: A list of real numbers

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
vars:

  "varid" rlist => { "0.1", "0.2", "0.3" };

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="policy-in-vars"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#rlist-in-vars">rlist in vars</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#vars-in-common-promises">vars in common promises</a>

</div>

<h4 class="subsection">6.1.7 <code>policy</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>free</code>
               <code>overridable</code>
               <code>constant</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: The policy for (dis)allowing redefinition of variables

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
vars:

  "varid" string => "value..."
          policy => "constant";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Variables can either be allowed to change their value dynamically (be
redefined) or they can be constant. The use of private variable spaces
in cfengine 3 makes it unlikely that variable redefinition would be
necessary in cfengine 3.

<div class="node">
<p><hr>
<a name="classes-in-common-promises"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#reports-in-common-promises">reports in common promises</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#vars-in-common-promises">vars in common promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-common">Bundles for common</a>

</div>

<h3 class="section">6.2 <code>classes</code> promises</h3>

<p><br>

   <p>Whereas most promise types are specific to a particular kind of
interpretation that requires a typed interpreter (the bundle type),
a number of promises can be made in any kind of bundle since they
are of a generic input/output nature. These are listed below.

<ul class="menu">
<li><a accesskey="1" href="#or-in-classes">or in classes</a>
<li><a accesskey="2" href="#and-in-classes">and in classes</a>
<li><a accesskey="3" href="#xor-in-classes">xor in classes</a>
<li><a accesskey="4" href="#dist-in-classes">dist in classes</a>
<li><a accesskey="5" href="#expression-in-classes">expression in classes</a>
<li><a accesskey="6" href="#not-in-classes">not in classes</a>
</ul>

<div class="node">
<p><hr>
<a name="or-in-classes"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#and-in-classes">and in classes</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#classes-in-common-promises">classes in common promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#classes-in-common-promises">classes in common promises</a>

</div>

<h4 class="subsection">6.2.1 <code>or</code></h4>

<p class="noindent"><b>Type</b>: clist

<p class="noindent"><b>Allowed input range</b>: <code>[a-zA-Z0-9_!&amp;@$|.()]+</code>

<p class="noindent"><b>Synopsis</b>: Combine class sources with inclusive OR

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
classes:

    "compound_test" 

      or => { classmatch("linux_x86_64_2_6_22.*"), "suse_10_3" };

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>A useful construction for writing expressions that contain special functions.

<div class="node">
<p><hr>
<a name="and-in-classes"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#xor-in-classes">xor in classes</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#or-in-classes">or in classes</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#classes-in-common-promises">classes in common promises</a>

</div>

<h4 class="subsection">6.2.2 <code>and</code></h4>

<p class="noindent"><b>Type</b>: clist

<p class="noindent"><b>Allowed input range</b>: <code>[a-zA-Z0-9_!&amp;@$|.()]+</code>

<p class="noindent"><b>Synopsis</b>: Combine class sources with AND

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
classes:

  "compound_class" and => { classmatch("host[0-9].*"), "Monday", "Hr02" };

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If an expression contains a mixture of different object types that
need to be ANDed together, this list form is more convenient than
providing an expression.

<div class="node">
<p><hr>
<a name="xor-in-classes"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#dist-in-classes">dist in classes</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#and-in-classes">and in classes</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#classes-in-common-promises">classes in common promises</a>

</div>

<h4 class="subsection">6.2.3 <code>xor</code></h4>

<p class="noindent"><b>Type</b>: clist

<p class="noindent"><b>Allowed input range</b>: <code>[a-zA-Z0-9_!&amp;@$|.()]+</code>

<p class="noindent"><b>Synopsis</b>: Combine class sources with XOR

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
classes:

 "another_global" xor => { "any", "linux", "solaris"};

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="dist-in-classes"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#expression-in-classes">expression in classes</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#xor-in-classes">xor in classes</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#classes-in-common-promises">classes in common promises</a>

</div>

<h4 class="subsection">6.2.4 <code>dist</code></h4>

<p class="noindent"><b>Type</b>: rlist

<p class="noindent"><b>Allowed input range</b>: <code>-9.99999E100,9.99999E100</code>

<p class="noindent"><b>Synopsis</b>: Generate a probabilistic class distribution (strategy in cfengine 2)

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
classes:

  "my_dist"  

    dist => { "10", "20", "40", "50" };

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Assign one exclusive class randomly weighted on a probability distribution. 
This will generate the following classes:

<pre class="smallexample">     my_dist    (always)
     my_dist_10 (10/120 of the time)
     my_dist_20 (20/120 of the time)
     my_dist_40 (40/120 of the time)
     my_dist_50 (50/120 of the time)
</pre>
   <p>This was previous called a &lsquo;<samp><span class="samp">strategy</span></samp>&rsquo; in cfengine 2.

<div class="node">
<p><hr>
<a name="expression-in-classes"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#not-in-classes">not in classes</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#dist-in-classes">dist in classes</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#classes-in-common-promises">classes in common promises</a>

</div>

<h4 class="subsection">6.2.5 <code>expression</code></h4>

<p class="noindent"><b>Type</b>: class

<p class="noindent"><b>Allowed input range</b>: <code>[a-zA-Z0-9_!&amp;@$|.()]+</code>

<p class="noindent"><b>Synopsis</b>: Evaluate string expression of classes in normal form

<p class="noindent"><b>Example</b>:<br>
<br>
<pre class="verbatim">
classes:

  "class_name" expression => "solaris|(linux.specialclass)";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>A way of aliasing class combinations.

<div class="node">
<p><hr>
<a name="not-in-classes"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#expression-in-classes">expression in classes</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#classes-in-common-promises">classes in common promises</a>

</div>

<h4 class="subsection">6.2.6 <code>not</code></h4>

<p class="noindent"><b>Type</b>: class

<p class="noindent"><b>Allowed input range</b>: <code>[a-zA-Z0-9_!&amp;@$|.()]+</code>

<p class="noindent"><b>Synopsis</b>: Evaluate the negation of string expression in normal form

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
classes:

   "others"  not => "linux|solaris";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>In file editing, this negates the effect of the promiser-pattern regular expression.

<div class="node">
<p><hr>
<a name="reports-in-common-promises"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#g_t_002a-in-agent-promises">* in agent promises</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#classes-in-common-promises">classes in common promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-common">Bundles for common</a>

</div>

<h3 class="section">6.3 <code>reports</code> promises</h3>

<p><br>

   <p>Whereas most promise types are specific to a particular kind of
interpretation that requires a typed interpreter (the bundle type),
a number of promises can be made in any kind of bundle since they
are of a generic input/output nature. These are listed below.

<ul class="menu">
<li><a accesskey="1" href="#friend_005fpattern-in-reports">friend_pattern in reports</a>
<li><a accesskey="2" href="#intermittency-in-reports">intermittency in reports</a>
<li><a accesskey="3" href="#lastseen-in-reports">lastseen in reports</a>
<li><a accesskey="4" href="#printfile-in-reports">printfile in reports</a>
<li><a accesskey="5" href="#report_005fto_005ffile-in-reports">report_to_file in reports</a>
<li><a accesskey="6" href="#showstate-in-reports">showstate in reports</a>
</ul>

<div class="node">
<p><hr>
<a name="friend_pattern-in-reports"></a>
<a name="friend_005fpattern-in-reports"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#intermittency-in-reports">intermittency in reports</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#reports-in-common-promises">reports in common promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#reports-in-common-promises">reports in common promises</a>

</div>

<h4 class="subsection">6.3.1 <code>friend_pattern</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: Regular expression to keep selected hosts from the friends report list

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
reports:

  linux::

   "Friend status report"

          lastseen => "0"
     friend_patten => "host1|host2|.*\.domain\.tld";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This regular expression should match hosts we want to exclude from friend reports.

<div class="node">
<p><hr>
<a name="intermittency-in-reports"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#lastseen-in-reports">lastseen in reports</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#friend_005fpattern-in-reports">friend_pattern in reports</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#reports-in-common-promises">reports in common promises</a>

</div>

<h4 class="subsection">6.3.2 <code>intermittency</code></h4>

<p class="noindent"><b>Type</b>: real

<p class="noindent"><b>Allowed input range</b>: <code>0,1</code>

<p class="noindent"><b>Synopsis</b>: Real number threshold [0,1] of intermittency about current peers, report above

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
reports:

  "Comment"

    intermittency => "0.5";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Report on cfengine peers in the neighbourhood watch whose observed
irregularity of connection exceeds 0.5 scaled entropy units, meaning
that they show an erratic pattern of connection.

<div class="node">
<p><hr>
<a name="lastseen-in-reports"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#printfile-in-reports">printfile in reports</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#intermittency-in-reports">intermittency in reports</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#reports-in-common-promises">reports in common promises</a>

</div>

<h4 class="subsection">6.3.3 <code>lastseen</code></h4>

<p class="noindent"><b>Type</b>: int

<p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

<p class="noindent"><b>Synopsis</b>: Integer time threshold in hours since current peers were last seen, report absence

<p class="noindent"><b>Example</b>:<br>
<br>

   <p>In control:
<pre class="verbatim">
body agent control
{
lastseen => "false";
}

</pre>

   <p>See also in reports:
<pre class="verbatim">
reports:

  "Comment"

    lastseen => "10";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>In reports: after this time (hours) has passed, references to the external peer
will be purged from this host's database.

   <p>In control: determines whether cfengine will records last seen
intermittency profiles (reliability diagnostics) in
<samp><span class="file">WORKDIR/lastseen</span></samp>. This generates a separate file for each each
host that connects to the current host.  For central hubs this can
result is a huge number of files.

<div class="node">
<p><hr>
<a name="printfile-in-reports"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#report_005fto_005ffile-in-reports">report_to_file in reports</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#lastseen-in-reports">lastseen in reports</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#reports-in-common-promises">reports in common promises</a>

</div>

<h4 class="subsection">6.3.4 <code>printfile</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>file_to_print</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

     <p class="noindent"><b>Synopsis</b>: Path name to the file that is to be sent to standard output

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body printfile example
     {
     file_to_print   => "/etc/motd";
     number_of_lines => "10";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Include part of a file in a report.

     <br><dt>&lsquo;<samp><code>number_of_lines</code></samp>&rsquo;<dd><b>Type</b>: int

     <p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

     <p class="noindent"><b>Synopsis</b>: Integer maximum number of lines to print from selected file

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body printfile example
     {
     number_of_lines => "10";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

   </dl>

<div class="node">
<p><hr>
<a name="report_to_file-in-reports"></a>
<a name="report_005fto_005ffile-in-reports"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#showstate-in-reports">showstate in reports</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#printfile-in-reports">printfile in reports</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#reports-in-common-promises">reports in common promises</a>

</div>

<h4 class="subsection">6.3.5 <code>report_to_file</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

<p class="noindent"><b>Synopsis</b>: The path and filename to which output should be appended

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
bundle agent test
{
reports:

  linux::

   "$(sys.date),This is a report from $(sys.host)"

       report_to_file => "/tmp/test_log";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Append the output of the report to the named file instead of standard
output.  If the file cannot be opened for writing then the report
defaults to the standard output.

<div class="node">
<p><hr>
<a name="showstate-in-reports"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#report_005fto_005ffile-in-reports">report_to_file in reports</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#reports-in-common-promises">reports in common promises</a>

</div>

<h4 class="subsection">6.3.6 <code>showstate</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: List of services about which status reports should be reported to standard output

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
reports:

  "Comment"

    showstate => {"www_in", "ssh_out", "otherprocs" };

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The basic list of services is:

     <dl>
<dt>&lsquo;<samp><span class="samp">users</span></samp>&rsquo;<dd>Users logged in
<br><dt>&lsquo;<samp><span class="samp">rootprocs</span></samp>&rsquo;<dd>Privileged system processes
<br><dt>&lsquo;<samp><span class="samp">otherprocs</span></samp>&rsquo;<dd>Non-privileged process
<br><dt>&lsquo;<samp><span class="samp">diskfree</span></samp>&rsquo;<dd>Free disk on / partition
<br><dt>&lsquo;<samp><span class="samp">loadavg</span></samp>&rsquo;<dd>% kernel load utilization
<br><dt>&lsquo;<samp><span class="samp">netbiosns_in</span></samp>&rsquo;<dd>netbios name lookups (in)
<br><dt>&lsquo;<samp><span class="samp">netbiosns_out</span></samp>&rsquo;<dd>netbios name lookups (out)
<br><dt>&lsquo;<samp><span class="samp">netbiosdgm_in</span></samp>&rsquo;<dd>netbios name datagrams (in)
<br><dt>&lsquo;<samp><span class="samp">netbiosdgm_out</span></samp>&rsquo;<dd>netbios name datagrams (out)
<br><dt>&lsquo;<samp><span class="samp">netbiosssn_in</span></samp>&rsquo;<dd>netbios name sessions (in)
<br><dt>&lsquo;<samp><span class="samp">netbiosssn_out</span></samp>&rsquo;<dd>netbios name sessions (out)
<br><dt>&lsquo;<samp><span class="samp">irc_in</span></samp>&rsquo;<dd>IRC connections (in)
<br><dt>&lsquo;<samp><span class="samp">irc_out</span></samp>&rsquo;<dd>IRC connections (out)
<br><dt>&lsquo;<samp><span class="samp">cfengine_in</span></samp>&rsquo;<dd>cfengine connections (in)
<br><dt>&lsquo;<samp><span class="samp">cfengine_out</span></samp>&rsquo;<dd>cfengine connections (out)
<br><dt>&lsquo;<samp><span class="samp">nfsd_in</span></samp>&rsquo;<dd>nfs connections (in)
<br><dt>&lsquo;<samp><span class="samp">nfsd_out</span></samp>&rsquo;<dd>nfs connections (out)
<br><dt>&lsquo;<samp><span class="samp">smtp_in</span></samp>&rsquo;<dd>smtp connections (in)
<br><dt>&lsquo;<samp><span class="samp">smtp_out</span></samp>&rsquo;<dd>smtp connections (out)
<br><dt>&lsquo;<samp><span class="samp">www_in</span></samp>&rsquo;<dd>www connections (in)
<br><dt>&lsquo;<samp><span class="samp">www_out</span></samp>&rsquo;<dd>www connections (out)
<br><dt>&lsquo;<samp><span class="samp">ftp_in</span></samp>&rsquo;<dd>ftp connections (in)
<br><dt>&lsquo;<samp><span class="samp">ftp_out</span></samp>&rsquo;<dd>ftp connections (out)
<br><dt>&lsquo;<samp><span class="samp">ssh_in</span></samp>&rsquo;<dd>ssh connections (in)
<br><dt>&lsquo;<samp><span class="samp">ssh_out</span></samp>&rsquo;<dd>ssh connections (out)
<br><dt>&lsquo;<samp><span class="samp">wwws_in</span></samp>&rsquo;<dd>wwws connections (in)
<br><dt>&lsquo;<samp><span class="samp">wwws_out</span></samp>&rsquo;<dd>wwws connections (out)
<br><dt>&lsquo;<samp><span class="samp">icmp_in</span></samp>&rsquo;<dd>ICMP packets (in)
<br><dt>&lsquo;<samp><span class="samp">icmp_out</span></samp>&rsquo;<dd>ICMP packets (out)
<br><dt>&lsquo;<samp><span class="samp">udp_in</span></samp>&rsquo;<dd>UDP dgrams (in)
<br><dt>&lsquo;<samp><span class="samp">udp_out</span></samp>&rsquo;<dd>UDP dgrams (out)
<br><dt>&lsquo;<samp><span class="samp">dns_in</span></samp>&rsquo;<dd>DNS requests (in)
<br><dt>&lsquo;<samp><span class="samp">dns_out</span></samp>&rsquo;<dd>DNS requests (out)
<br><dt>&lsquo;<samp><span class="samp">tcpsyn_in</span></samp>&rsquo;<dd>TCP sessions (in)
<br><dt>&lsquo;<samp><span class="samp">tcpsyn_out</span></samp>&rsquo;<dd>TCP sessions (out)
<br><dt>&lsquo;<samp><span class="samp">tcpack_in</span></samp>&rsquo;<dd>TCP acks (in)
<br><dt>&lsquo;<samp><span class="samp">tcpack_out</span></samp>&rsquo;<dd>TCP acks (out)
<br><dt>&lsquo;<samp><span class="samp">tcpfin_in</span></samp>&rsquo;<dd>TCP finish (in)
<br><dt>&lsquo;<samp><span class="samp">tcpfin_out</span></samp>&rsquo;<dd>TCP finish (out)
<br><dt>&lsquo;<samp><span class="samp">tcpmisc_in</span></samp>&rsquo;<dd>TCP misc (in)
<br><dt>&lsquo;<samp><span class="samp">tcpmisc_out</span></samp>&rsquo;<dd>TCP misc (out)
<br><dt>&lsquo;<samp><span class="samp">webaccess</span></samp>&rsquo;<dd>Webserver hits
<br><dt>&lsquo;<samp><span class="samp">weberrors</span></samp>&rsquo;<dd>Webserver errors
<br><dt>&lsquo;<samp><span class="samp">syslog</span></samp>&rsquo;<dd>New log entries (Syslog)
<br><dt>&lsquo;<samp><span class="samp">messages</span></samp>&rsquo;<dd>New log entries (messages)
<br><dt>&lsquo;<samp><span class="samp">temp0</span></samp>&rsquo;<dd>CPU Temperature 0
<br><dt>&lsquo;<samp><span class="samp">temp1</span></samp>&rsquo;<dd>CPU Temperature 1
<br><dt>&lsquo;<samp><span class="samp">temp2</span></samp>&rsquo;<dd>CPU Temperature 2
<br><dt>&lsquo;<samp><span class="samp">temp3</span></samp>&rsquo;<dd>CPU Temperature 3
<br><dt>&lsquo;<samp><span class="samp">cpu</span></samp>&rsquo;<dd>%CPU utilization (all)
<br><dt>&lsquo;<samp><span class="samp">cpu0</span></samp>&rsquo;<dd>%CPU utilization 0
<br><dt>&lsquo;<samp><span class="samp">cpu1</span></samp>&rsquo;<dd>%CPU utilization 1
<br><dt>&lsquo;<samp><span class="samp">cpu2</span></samp>&rsquo;<dd>%CPU utilization 2
<br><dt>&lsquo;<samp><span class="samp">cpu3</span></samp>&rsquo;<dd>%CPU utilization 3
</dl>

<div class="node">
<p><hr>
<a name="*-in-agent-promises"></a>
<a name="g_t_002a-in-agent-promises"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#g_t_002a-in-edit_005fline-promises">* in edit_line promises</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#reports-in-common-promises">reports in common promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-common">Bundles for common</a>

</div>

<h3 class="section">6.4 <code>*</code> promises in &lsquo;<samp><span class="samp">agent</span></samp>&rsquo;</h3>

<p><br>

   <p>Most promise bodies belong to one and only one type of promise.  The
generic `*' promises bodies can be added to any promise type in
<code>cf-agent</code>, hence the star which means `any'.

   <p>The body attributes described below can be added to any promise rule
in the agent. These promises address matters of a completely general
nature &ndash; how cfengine behaves as it attempts to keep a promise,
comments about the promises etc.

   <p><br>

<pre class="verbatim">
files:

   "/etc/passwd" -> "Security team"

      perms  => p("644"),
      action => justcheck,
      comment => "This was decided in internal procedures XYZ123";

</pre>

   <p><br>

<ul class="menu">
<li><a accesskey="1" href="#action-in-_002a">action in *</a>
<li><a accesskey="2" href="#classes-in-_002a">classes in *</a>
<li><a accesskey="3" href="#ifvarclass-in-_002a">ifvarclass in *</a>
<li><a accesskey="4" href="#handle-in-_002a">handle in *</a>
<li><a accesskey="5" href="#depends_005fon-in-_002a">depends_on in *</a>
<li><a accesskey="6" href="#comment-in-_002a">comment in *</a>
</ul>

<div class="node">
<p><hr>
<a name="action-in-*"></a>
<a name="action-in-_002a"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#classes-in-_002a">classes in *</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#g_t_002a-in-agent-promises">* in agent promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#g_t_002a-in-agent-promises">* in agent promises</a>

</div>

<h4 class="subsection">6.4.1 <code>action</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>action_policy</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>fix</code>
                    <code>warn</code>
                    <code>nop</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Whether to repair or report about non-kept promises

     <p><b>Example</b>:<br>
<br>

     <p>The following example shows a simple use of transaction control,
causing the promise to be verified as a separate background process.

     <pre class="verbatim">     
     body action background
     
     {
     action_policy => "warn";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The <code>action</code> settings allow general transaction control to be
implemented on promise verification. Action bodies place limits on how
often to verify the promise and what classes to raise in the case that
the promise can or cannot be kept.

     <p>Note that actions can be added to sub-bundles like methods and editing
bundles, and that promises within these do not inherit action settings
at higher levels. Thus, in the following example there are two levels
of action setting:

     <pre class="verbatim">     ########################################################
     #
     # Warn if line matched
     #
     ########################################################
     
     body common control
     
     {
     bundlesequence  => { "testbundle" };
     }
     
     ########################################################
     
     bundle agent testbundle
     
     {
     files:
     
       "/var/cfengine/inputs/.*"
     
            edit_line => DeleteLinesMatching(".*cfenvd.*"),
            action => WarnOnly;
     }
     
     ########################################################
     
     bundle edit_line DeleteLinesMatching(regex)
       {
       delete_lines:
     
         "$(regex)" action => WarnOnly;
     
       }
     
     ########################################################
     
     body action WarnOnly
     {
     action_policy => "warn";
     }
</pre>

     <p>The <code>action</code> setting for the <code>files</code> promise means that file
edits will not be committed to disk, only warned about. This is a master-level
promise that overrides anything that happens during the editing. The
<code>action</code> setting for the edit bundle means that the internal
memory modelling of the file will only warn about changes rather than
committing them to the memory model. This makes little difference to the
end result, but it means that cfengine will report

     <pre class="smallexample">          Need to delete line - ... - but only a warning was promised
</pre>
     <p class="noindent">Instead of

     <pre class="smallexample">          Deleting the prpomised line ...
          Need to save file - but only a warning was promised
</pre>
     <p class="noindent">In either case, no changes will be made to the disk, but the messages
given by <code>cf-agent</code> will differ.

     <br><dt>&lsquo;<samp><code>ifelapsed</code></samp>&rsquo;<dd><b>Type</b>: int

     <p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

     <p class="noindent"><b>Synopsis</b>: Number of minutes before next allowed assessment of promise

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     #local
     
     body action example
     {
     ifelapsed   => "120";
     expireafter => "240";
     }
     
     # global
     
     body agent control
     {
     ifelapsed   => "120";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This overrides the global settings. Promises which take a long time to
verify should usually be protected with a long value for this
parameter.  This serves as a resource `spam' protection. A cfengine
check could easily run every 5 minutes provided resource intensive
operations are not performed on every run. Using time classes like
<code>Hr12</code> etc., is one part of this strategy; using <code>ifelapsed</code>
is another which is not tied to a specific time.

     <br><dt>&lsquo;<samp><code>expireafter</code></samp>&rsquo;<dd><b>Type</b>: int

     <p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

     <p class="noindent"><b>Synopsis</b>: Number of minutes before a repair action is interrupted and retried

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     body action example
     {
     ifelapsed   => "120";
     expireafter => "240";
     }
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The locking time after which cfengine will attempt to kill and restart
its attempt to keep a promise.

     <br><dt>&lsquo;<samp><code>log_string</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: A message to be written to the log when a promise verification leads to a repair

     <p><b>Example</b>:<br>
<br>

     <pre class="example">          
          <var>promise-type</var>:
          
           "promiser"
          
             attr =&gt; "value",
             action =&gt; log_me("checked $(this.promiser)");
          
          # ..
          
          body action log_me(s)
          {
          log_string =&gt; "$(s)";
          }
          
</pre>
     <p><b>Notes</b>:<br>
<br>

     <p>The <code>log_string</code> works together with <code>log_repair</code>,
<code>log_kept</code> etc, to define a string for logging to one of the named
files depending on promise outcome, or to standard output of the log file
is stipulared as &lsquo;<samp><span class="samp">stdout</span></samp>&rsquo;. Log strings on standard output are denoted
by an &lsquo;<samp><span class="samp">L:</span></samp>&rsquo; prefix.

     <p>Note that <code>log_string</code> does not interact with <code>log_level</code>,
which is about regular system output messages.

     <br><dt>&lsquo;<samp><code>log_level</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>inform</code>
                    <code>verbose</code>
                    <code>error</code>
                    <code>log</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: The reporting level sent to syslog

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body action example
     {
     log_level => "inform";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Use this as an alternative to auditing to use the syslog mechanism to centralize
or manage messaging from cfengine. A backup of these messages will still be
kept in <samp><span class="file">WORKDIR/outputs</span></samp> if you are using <code>cf-execd</code>.

     <br><dt>&lsquo;<samp><code>log_kept</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: This should be filename of a file to which log_string will be saved, if undefined it goes to syslog

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body action logme(x)
     {
     log_kept => "/tmp/private_keptlog.log";
     log_failed => "/tmp/private_faillog.log";
     log_repaired => "/tmp/private_replog.log";
     log_string => "$(sys.date) $(x) promise status";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>If this option is specified together with <code>log_string</code>, the
current promise will log promise-kept status using the log string to
this named file. If these log names are absent, the default logging
destination for the log string is syslog, but only for non-kept
promises. Only the <code>log_string</code> is affected by this setting. Other messages
destined for logging are sent to syslog.

     <p>It is intended that named file logs should be different for the three
cases: promise kept, promise not kept and promise repaired.

     <br><dt>&lsquo;<samp><code>log_repaired</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: This should be filename of a file to which log_string will be saved, if undefined it goes to syslog

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     bundle agent test
     {
     vars:
     
       "software" slist => { "/root/xyz", "/tmp/xyz" };
     
     files:
     
       "$(software)"
     
         create => "true",
          action => logme("$(software)");
     
     }
     
     
     body action logme(x)
     {
     log_kept => "/tmp/private_keptlog.log";
     log_failed => "/tmp/private_faillog.log";
     log_repaired => "/tmp/private_replog.log";
     log_string => "$(sys.date) $(x) promise status";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This may be the name of a log to which the <code>log_string</code> is written if a promise is repaired.

     <br><dt>&lsquo;<samp><code>log_failed</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: This should be filename of a file to which log_string will be saved, if undefined it goes to syslog

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     bundle agent test
     {
     vars:
     
       "software" slist => { "/root/xyz", "/tmp/xyz" };
     
     files:
     
       "$(software)"
     
         create => "true",
          action => logme("$(software)");
     
     }
     
     
     body action logme(x)
     {
     log_kept => "/tmp/private_keptlog.log";
     log_failed => "/tmp/private_faillog.log";
     log_repaired => "/tmp/private_replog.log";
     log_string => "$(sys.date) $(x) promise status";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>If this option is specified together with <code>log_string</code>, the
current promise will log promise-kept status using the log string to
this named file. If these log names are absent, the default logging
destination for the log string is syslog, but only for non-kept
promises. Only the <code>log_string</code> is affected by this setting. Other messages
destined for logging are sent to syslog.

     <p>It is intended that named file logs should be different for the three
cases: promise kept, promise not kept and promise repaired.

     <br><dt>&lsquo;<samp><code>audit</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false switch for detailed audit records of this promise

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body action example
     {
     # ...
     
     audit => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>If this is set, cfengine will perform auditing on this specific
promise. This means that all details surrounding the verification of
the current promise will be recorded in the audit database. The
database may be inspected with <code>cf-report</code>, or <code>cfshow</code> in
cfengine 2.

     <br><dt>&lsquo;<samp><code>background</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false switch for parallelizing the promise repair

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body action example
     {
     background => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>If possible, background the verification of the current promise. This
is advantageous only if the verification might take a significant
amount of time, e.g. in remote copying of filesystem/disk scans.

     <br><dt>&lsquo;<samp><code>report_level</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>inform</code>
                    <code>verbose</code>
                    <code>error</code>
                    <code>log</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: The reporting level for standard output

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body action example
     {
     report_level => "verbose";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>In cfengine 2 one would say &lsquo;<samp><span class="samp">inform=true</span></samp>&rsquo; or &lsquo;<samp><span class="samp">syslog=true</span></samp>&rsquo;, etc. 
This replaces these levels since they act as encapsulating super-sets.

     <br><dt>&lsquo;<samp><code>measurement_class</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: If set performance will be measured and recorded under this identifier

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     
     body action measure
     {
     measurement_class => "$(this.promiser) long job scan of /usr";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>By setting this string you switch on performance measurement for the
current promise, and also give the measurement a name. The identifier forms a
partial identity for optional performance scanning of promises of the form:

     <pre class="example">          <var>ID:promise-type:promiser</var>.
</pre>
     <p>These can be seen identifying  using <code>cf-reports</code>, e.g. in the
generated file <samp><span class="file">performance.html</span></samp>.

   </dl>

<div class="node">
<p><hr>
<a name="classes-in-*"></a>
<a name="classes-in-_002a"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#ifvarclass-in-_002a">ifvarclass in *</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#action-in-_002a">action in *</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#g_t_002a-in-agent-promises">* in agent promises</a>

</div>

<h4 class="subsection">6.4.2 <code>classes</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>promise_repaired</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>[a-zA-Z0-9_$.]+</code>

     <p class="noindent"><b>Synopsis</b>: A list of classes to be defined

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body classes example
     {
     promise_repaired => { "change_happened" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>If a promise is `repaired' it means that a corrective action had to be
taken to keep the promise.

     <p>Important: complex promises, e.g. <code>files</code> promises that set
multiple parameters on a file simultaneously can report misleadingly. 
The classes for different parts of a promise are not separable. Thus,
if you promise to create and file and change its permissions, when the
file exists with incorrect permissions, <code>cf-agent</code> will report
that the &lsquo;<samp><span class="samp">promise_kept</span></samp>&rsquo; for the file existence, but
&lsquo;<samp><span class="samp">promise_repaired</span></samp>&rsquo; for the permissions. If you need separate
reports, you should code two separate promises rather than `overloading'
a single one.

     <br><dt>&lsquo;<samp><code>repair_failed</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>[a-zA-Z0-9_$.]+</code>

     <p class="noindent"><b>Synopsis</b>: A list of classes to be defined

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body classes example
     {
     repair_failed => { "unknown_error" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>A promise could not be repaired because the corrective
action failed for some reason.

     <br><dt>&lsquo;<samp><code>repair_denied</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>[a-zA-Z0-9_$.]+</code>

     <p class="noindent"><b>Synopsis</b>: A list of classes to be defined

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body classes example
     {
     repair_denied => { "permission_failure" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>A promise could not be kept because access to a key resource
was denied.

     <br><dt>&lsquo;<samp><code>repair_timeout</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>[a-zA-Z0-9_$.]+</code>

     <p class="noindent"><b>Synopsis</b>: A list of classes to be defined

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body classes example
     {
     repair_timeout => { "too_slow", "did_not_wait" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>A promise maintenance repair timed-out waiting for some dependent resource.

     <br><dt>&lsquo;<samp><code>promise_kept</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>[a-zA-Z0-9_$.]+</code>

     <p class="noindent"><b>Synopsis</b>: A list of classes to be defined

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body classes example
     {
     promise_kept => { "success", "kaplah" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This class is set if no action was necessary by <code>cf-agent</code>
because the promise concerned was aready kept without further action
required.

     <p>Important: complex promises, e.g. <code>files</code> promises that set
multiple parameters on a file simultaneously can report misleadingly. 
The classes for different parts of a promise are not separable. Thus,
if you promise to create and file and change its permissions, when the
file exists with incorrect permissions, <code>cf-agent</code> will report
that the &lsquo;<samp><span class="samp">promise_kept</span></samp>&rsquo; for the file existence, but
&lsquo;<samp><span class="samp">promise_repaired</span></samp>&rsquo; for the permissions. If you need separate
reports, you should code two separate promises rather than `overloading'
a single one.

     <br><dt>&lsquo;<samp><code>persist_time</code></samp>&rsquo;<dd><b>Type</b>: int

     <p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

     <p class="noindent"><b>Synopsis</b>: A number of minutes the specified classes should remain active

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body classes example
     {
     persist_time => "10";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>By default classes are ephemeral entities that disappear when <code>cf-agent</code>
terminates. By setting a persistence time, they can last even when the agent
is not running.

     <br><dt>&lsquo;<samp><code>timer_policy</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>absolute</code>
                    <code>reset</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Whether a persistent class restarts its counter when rediscovered

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body classes example
     {
     timer_policy => "reset";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The in most cases resetting a timer will give a more honest appraisal
of which classes are currently important, but if we want to activate
a response of limited duration as a rare event then an asbolute
time limit is useful.

   </dl>

<div class="node">
<p><hr>
<a name="ifvarclass-in-*"></a>
<a name="ifvarclass-in-_002a"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#handle-in-_002a">handle in *</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#classes-in-_002a">classes in *</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#g_t_002a-in-agent-promises">* in agent promises</a>

</div>

<h4 class="subsection">6.4.3 <code>ifvarclass</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: Extended classes ANDed with context

<p class="noindent"><b>Example</b>:<br>
<br>

   <p>The generic example has the form:
<pre class="example">     
     <var>promise-type</var>:
     
       "<var>promiser</var>"
     
         ifvarclass =&gt; "$(program)_running|($(program)_notfound&amp;Hr12)";
     
</pre>
   <p class="noindent">A specific example would be:

<pre class="verbatim">
bundle agent example

{     
commands:

 any::

    "/bin/echo This is linux"

       ifvarclass => "linux";


    "/bin/echo This is solaris"

       ifvarclass => "solaris";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This is an additional class expression that will be evaluated after
the &lsquo;<samp><var>class</var><span class="samp">::</span></samp>&rsquo; classes have selected promises. It is
provided in order to enable a channel between variables and classes. 
The result is thus the logical AND of the ordinary classes and the
variable classes.

   <p>This function is provided so that one can form expressions that link
variables and classes, e.g.

<pre class="verbatim"># Check that all components are running

vars:

  "component" slist => { "cf-monitord", "cf-serverd" };

processes:

  "$(component)" restart_class => canonify("start_$(component)");

commands:

   "/var/cfengine/bin/$(component)"

       ifvarclass => canonify("start_$(component)");

</pre>

   <p>Notice that the function <code>canonify()</code> is provided to convert a
general variable input into a string composed only of legal
characters, using the same algorithm that cfengine uses.

<div class="node">
<p><hr>
<a name="handle-in-*"></a>
<a name="handle-in-_002a"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#depends_005fon-in-_002a">depends_on in *</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#ifvarclass-in-_002a">ifvarclass in *</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#g_t_002a-in-agent-promises">* in agent promises</a>

</div>

<h4 class="subsection">6.4.4 <code>handle</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>[a-zA-Z0-9_$.]+</code>

<p class="noindent"><b>Synopsis</b>: A unique id-tag string for referring to this as a promisee elsewhere

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
access:

  "/source"

    handle  => "update_rule",
    admit   => { "127.0.0.1" };

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>A promise handle is like a `goto' label. It allows you to refer to a promise as the promisee
of <code>depends_on</code> client of another promise. Handles are essential for mapping dependencies
and performing impact analyses.

<div class="node">
<p><hr>
<a name="depends_on-in-*"></a>
<a name="depends_005fon-in-_002a"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#comment-in-_002a">comment in *</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#handle-in-_002a">handle in *</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#g_t_002a-in-agent-promises">* in agent promises</a>

</div>

<h4 class="subsection">6.4.5 <code>depends_on</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: A list of promise handles that this promise builds on or depends on somehow (for knowledge management)

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
files:

  "/home/mark/tmp/testcopy" 

    builds_on    => { "server_promise_1" },
    copy_from    => mycopy("/source");

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This is a list of promise handles for whom this promise is a promisee. In other words,
we acknowledge that this promise will be affected by the list of promises whose handles
are specified.

<div class="node">
<p><hr>
<a name="comment-in-*"></a>
<a name="comment-in-_002a"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#depends_005fon-in-_002a">depends_on in *</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#g_t_002a-in-agent-promises">* in agent promises</a>

</div>

<h4 class="subsection">6.4.6 <code>comment</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: A comment about this promise's real intention that follows through the program

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
comment => "This comment follows the data for reference ...",

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Comments written in code follow the program, they are not merely discarded. 
They appear in reports and error messages.

<div class="node">
<p><hr>
<a name="*-in-edit_line-promises"></a>
<a name="g_t_002a-in-edit_005fline-promises"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#g_t_002a-in-agent-promises">* in agent promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-common">Bundles for common</a>

</div>

<h3 class="section">6.5 <code>*</code> promises in &lsquo;<samp><span class="samp">edit_line</span></samp>&rsquo;</h3>

<p><br>

   <p>Most promise bodies belong to one and only one type of promise.  The
generic `*' promises bodies can be added to any promise type in
<code>cf-agent</code>, hence the star which means `any'.

   <p>The body attributes described below can be added to any promise rule
in the agent. These promises address matters of a completely general
nature &ndash; how cfengine behaves as it attempts to keep a promise,
comments about the promises etc.

   <p><br>

<pre class="verbatim">
files:

   "/etc/passwd" -> "Security team"

      perms  => p("644"),
      action => justcheck,
      comment => "This was decided in internal procedures XYZ123";

</pre>

   <p><br>

<ul class="menu">
<li><a accesskey="1" href="#select_005fregion-in-_002a">select_region in *</a>
</ul>

<div class="node">
<p><hr>
<a name="select_region-in-*"></a>
<a name="select_005fregion-in-_002a"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#g_t_002a-in-edit_005fline-promises">* in edit_line promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#g_t_002a-in-edit_005fline-promises">* in edit_line promises</a>

</div>

<h4 class="subsection">6.5.1 <code>select_region</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>select_start</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: Regular expression matching start of edit region

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body select_region example(x)
     
     {
     select_start => "\[$(x)\]";
     select_end => "\[.*\]";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>See also <code>select_end</code>. These delimiters mark out the region
of a file to be edited. In the example, it is assumed that the file
has section markers.

     <pre class="smallexample">          [section 1]
          
          lines.
          lines...
          
          
          [section 2]
          
          lines ....
          etc..
          
</pre>
     <p class="noindent">The start marker includes the first matched line.

     <br><dt>&lsquo;<samp><code>select_end</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: Regular expression matches end of edit region from start

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body select_region example(x)
     
     {
     select_start => "\[$(x)\]";
     select_end => "\[.*\]";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>See also <code>select_start</code>. These delimiters mark out the region
of a file to be edited. In the example, it is assumed that the file
has section markes

     <pre class="smallexample">          [section 1]
          
          lines.
          lines...
          
          
          [section 2]
          
          lines ....
          etc..
          
</pre>
     <p>If you want to match from a starting location to the end of file, then just omit
the <code>select_end</code> promise and it will run to the end of file.

   </dl>
   <!-- ***************************************************** -->
<!-- * CHAPTER -->
<!-- ***************************************************** -->
<div class="node">
<p><hr>
<a name="Bundles-for-agent"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Bundles-for-server">Bundles for server</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Bundles-for-common">Bundles for common</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Top">Top</a>

</div>

<h2 class="chapter">7 Bundles of <code>agent</code></h2>

<p><br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
     bundle agent main(parameter)
     
     {
     vars:
     
       "sys_files"    slist        =&gt; {
                                      "/etc/passwd",
                                      "/etc/services"
                                      };
     files:
     
       "$(sys_files)" perms        =&gt; p("root","0644"),
                      changes      =&gt; trip_wire;
     
       "/etc/shadow"  perms        =&gt; p("root","0600"),
                      changes      =&gt; trip_wire;
     
       "/usr"         changes      =&gt; trip_wire,
                      depth_search =&gt; recurse("inf");
     
       "/tmp"         delete       =&gt; tidy,
                      file_select  =&gt; days("2"),
                      depth_search =&gt; recurse("inf");
     
     }
     
</pre>
   </td></tr></table>

   <p><br>

   <p>Agent bundles contain user-defined promises for <code>cf-agent</code>. The
types of promises and their corresponding bodies are detailed below.

<ul class="menu">
<li><a accesskey="1" href="#commands-in-agent-promises">commands in agent promises</a>
<li><a accesskey="2" href="#databases-in-agent-promises">databases in agent promises</a>
<li><a accesskey="3" href="#files-in-agent-promises">files in agent promises</a>
<li><a accesskey="4" href="#delete_005flines-in-edit_005fline-promises">delete_lines in edit_line promises</a>
<li><a accesskey="5" href="#insert_005flines-in-edit_005fline-promises">insert_lines in edit_line promises</a>
<li><a accesskey="6" href="#field_005fedits-in-edit_005fline-promises">field_edits in edit_line promises</a>
<li><a accesskey="7" href="#replace_005fpatterns-in-edit_005fline-promises">replace_patterns in edit_line promises</a>
<li><a accesskey="8" href="#interfaces-in-agent-promises">interfaces in agent promises</a>
<li><a accesskey="9" href="#methods-in-agent-promises">methods in agent promises</a>
<li><a href="#packages-in-agent-promises">packages in agent promises</a>
<li><a href="#processes-in-agent-promises">processes in agent promises</a>
<li><a href="#storage-in-agent-promises">storage in agent promises</a>
</ul>

<div class="node">
<p><hr>
<a name="commands-in-agent-promises"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#databases-in-agent-promises">databases in agent promises</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Bundles-for-agent">Bundles for agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-agent">Bundles for agent</a>

</div>

<h3 class="section">7.1 <code>commands</code> promises in &lsquo;<samp><span class="samp">agent</span></samp>&rsquo;</h3>

<p><br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
     commands:
     
       <var>"/path/to/command args"</var>
     
                  args =&gt; "<var>more args</var>",
                  contain =&gt; <var>contain_body</var>,
                  module =&gt; <var>true/false</var>;
     
</pre>
   </td></tr></table>

   <p>Command <i>containment</i> allows you to make a `sandbox' around a
command, to run it as a non-privileged user inside an isolated
directory tree. Cfengine <code>modules</code> are commands that support a simple
protocol (see below) in order to set additional variables and classes
on execution from user defined code. Modules are intended for use as
system probes rather than additional configuration promises.

   <p>In cfengine 3 commands and processes have been separated
cleanly. Restarting of processes must be coded as a separate
command. This stricter type separation will allow more careful
conflict analysis to be carried out.

   <p>Output from commands executed here is quoted inline, but prefixed
with the letter &lsquo;<samp><span class="samp">Q</span></samp>&rsquo; to distinguish it from other output, e.g. 
from <code>reports</code>.

   <p>Commands were called <code>shellcommands</code> in cfengine previously. 
Modules were

   <p><i>NOTE: a common mistake in using cfengine is to embed many shell
commands instead of using the built-in functionality. Use of cfengine
internals is preferred as it assures convergence and proper integrated
checking. Extensive use of shell commands will make a cfengine
execution very heavy-weight like other management systems. To minimize
the system cost of execution, always use cfengine internals.</i>

   <p><br>

<pre class="verbatim">
bundle agent example

{
commands:

  "/bin/sleep 10"
     action  => background;

  "/bin/sleep"
     args => "20",
     action  => background;

}

</pre>

   <p><br>

<ul class="menu">
<li><a accesskey="1" href="#args-in-commands">args in commands</a>
<li><a accesskey="2" href="#contain-in-commands">contain in commands</a>
<li><a accesskey="3" href="#module-in-commands">module in commands</a>
</ul>

<div class="node">
<p><hr>
<a name="args-in-commands"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#contain-in-commands">contain in commands</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#commands-in-agent-promises">commands in agent promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#commands-in-agent-promises">commands in agent promises</a>

</div>

<h4 class="subsection">7.1.1 <code>args</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: Alternative string of arguments for the command (concatenated with promiser string)

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
commands:

  "/bin/echo one"

   args => "two three";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Sometimes it is convenient to separate the arguments to a command from
the command itself. The final arguments are the concatenation with one
space. So in the example above the command would be

<pre class="verbatim">
 /bin/echo one two three

</pre>

<div class="node">
<p><hr>
<a name="contain-in-commands"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#module-in-commands">module in commands</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#args-in-commands">args in commands</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#commands-in-agent-promises">commands in agent promises</a>

</div>

<h4 class="subsection">7.1.2 <code>contain</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>useshell</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false embed the command in a shell environment (true)

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body contain example
     {
     useshell => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The default is to use a shell when executing commands, but this has both
resource and security consequences. A shell consumes an extra process
and inherits environment variables, reads commands from files and performs
other actions beyond the control of cfengine. If one does not need shell
functionality such as piping through multiple commands then it is best
to manage without it.

     <br><dt>&lsquo;<samp><code>umask</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>0</code>
                    <code>77</code>
                    <code>22</code>
                    <code>27</code>
                    <code>72</code>
                    <code>077</code>
                    <code>022</code>
                    <code>027</code>
                    <code>072</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: The umask value for the child process

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body contain example
     {
     umask => "077";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Sets the internal umask for the process. Default value for the mask is &lsquo;<samp><span class="samp">077</span></samp>&rsquo;;

     <br><dt>&lsquo;<samp><code>exec_owner</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: The user name or id under which to run the process

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body contain example
     {
     exec_owner => "mysql_user";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This is part of the restriction of privilege for child processes
when running <code>cf-agent</code> as the root user, or a user with privileges.

     <br><dt>&lsquo;<samp><code>exec_group</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: The group name or id under which to run the process

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body contain example
     {
     exec_group => "nogroup";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This is part of the restriction of privilege for child processes
when running <code>cf-agent</code> as the root user, or a user with privileges.

     <br><dt>&lsquo;<samp><code>exec_timeout</code></samp>&rsquo;<dd><b>Type</b>: int

     <p class="noindent"><b>Allowed input range</b>: <code>1,3600</code>

     <p class="noindent"><b>Synopsis</b>: Timeout in seconds for command completion

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body contain example
     {
     exec_timeout => "30";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Attempt to time-out after this number of seconds. This cannot be guaranteed as not all
commands are willing to be interrupted in case of failure.

     <br><dt>&lsquo;<samp><code>chdir</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

     <p class="noindent"><b>Synopsis</b>: Directory for setting current/base directory for the process

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body contain example
     
     {
     chdir => "/containment/directory";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This command has the effect of placing the running command into a current working
directory equal to the parameter given, i.e. it works like the &lsquo;<samp><span class="samp">cd</span></samp>&rsquo; shell command.

     <br><dt>&lsquo;<samp><code>chroot</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

     <p class="noindent"><b>Synopsis</b>: Directory of root sandbox for process

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body contain example
     
     {
     chroot => "/private/path";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Sets the path of the directory that will be experienced as the top-most
root directory for the process. In security parlance, this creates
a `sandbox' for the process.

     <br><dt>&lsquo;<samp><code>preview</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false preview command when running in dry-run mode (with -n)

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body contain example
     {
     preview => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Previewing shell scripts during a dry-run is a potentially misleading
activity. It should only be used on scripts that make no changes to
the system. It is cfengine best practice to never write
change-functionality into user-written scripts except as a last
resort: cfengine can apply its safety checks to user defined scripts.

     <br><dt>&lsquo;<samp><code>no_output</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false discard all output from the command

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body contain example
     {
     no_output => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This is equivalent to piping standard output and error to <samp><span class="file">/dev/null</span></samp>.

   </dl>

<div class="node">
<p><hr>
<a name="module-in-commands"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#contain-in-commands">contain in commands</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#commands-in-agent-promises">commands in agent promises</a>

</div>

<h4 class="subsection">7.1.3 <code>module</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false whether to expect the cfengine module protocol

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
commands:

   "/masterfiles/user_script"

     module => "true";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If true, the module protocol is supported for this script, i.e. it is treated as a user
module. A plug-in module may
be written in any language, it can return any output you like, but lines
which begin with a &lsquo;<samp><span class="samp">+</span></samp>&rsquo; sign are treated as classes to be defined
(like <samp><span class="option">-D</span></samp>), while lines which begin with a &lsquo;<samp><span class="samp">-</span></samp>&rsquo; sign are
treated as classes to be undefined (like <samp><span class="option">-N</span></samp>).  Lines starting
with &lsquo;<samp><span class="samp">=</span></samp>&rsquo; are variables/macros to be defined.  Any other lines of
output are cited by cfagent, so you should normally make your module
completely silent.  Here is an example module written in perl.

<pre class="smallexample">     #!/usr/bin/perl
     #
     # module:myplugin
     #
     
       # lots of computation....
     
     if (<var>special-condition</var>)
        {
        print "+specialclass";
        }
     
</pre>
   <p>Modules inherit the environment variables from cfagent and accept arguments, just
as a regular command does.

<pre class="smallexample">     #!/bin/sh
     #
     # module:myplugin
     #
     
     /bin/echo $*
     
</pre>
   <p><code>cf-agent</code> defines the classes as an environment variable so that programs
have access to these. E.g. try the following module:

<pre class="smallexample">     #!/usr/bin/perl
     
     print "Decoding $ENV{CFALLCLASSES}\n";
     
     @allclasses = split (":","$ENV{CFALLCLASSES}");
     
     while ($c=shift(@allclasses))
       {
       $classes{$c} = 1;
       print "$c is set\n";
       }
     
</pre>
   <p>Modules define variables in <code>cf-agent</code> by outputting strings of the form

<pre class="smallexample">     
     =<var>variablename</var>=<var>value</var>
     
</pre>
   <p>These variables end up in a context which has the same name as the module. 
When the <code>$(allclasses)</code> variable becomes too large to manipulate conveniently,
you can access the complete list of currently defined classes in the file
<samp><span class="file">/var/cfengine/state/allclasses</span></samp>.

<div class="node">
<p><hr>
<a name="databases-in-agent-promises"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#files-in-agent-promises">files in agent promises</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#commands-in-agent-promises">commands in agent promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-agent">Bundles for agent</a>

</div>

<h3 class="section">7.2 <code>databases</code> promises in &lsquo;<samp><span class="samp">agent</span></samp>&rsquo;</h3>

<p><br>

   <p><i>These features apply to Enterprise versions of cfengine only</i>.

   <p>Cfengine Nova can interact with commonly used database servers to keep
promises about the structure and content of data within them.

   <p>There are two main cases of database management to address: small
embedded databases and large centralized databases.

   <p>Cfengine is a tool whose strength lies distributed management of
computers.  Databases are often centralized entities that have
single point of management, so a large monolithic database
is more easily managed with other tools. However, cfengine can still
monitor changes and discrepancies, and it can manage smaller embedded
databases that are distributed in nature, whether they are SQL,
registry or future types.

   <p>So creating 100 new databsaes for test purposes is a task for
cfengine, but adding a new item to an important production database is
not a task that we recommend using cfengine for.

   <p>There are three kinds of database supported by Nova:

     <dl>
<dt><em>LDAP - The Lightweight Directory Access Protocol</em><dd>A hierarchical network database primarily for reading simple schema.

     <br><dt><em>SQL - Structured Query Language</em><dd>A number of relational databases (currently supported: MySQL, Postgres)
for reading and writing complex data.

     <br><dt><em>Registry - Microsoft Registry</em><dd>An embedded database for interfacing with system values in Microsodt Windows.

   </dl>
   In addition, cfengine uses a  variety of embedded databases
for its own internals.

   <p>Cfengine's ability to make promises about databases depends on the
good grace of the database server. Embedded databases are directly
part of the system and promises can be made directly. However,
databases running through a server process (either on the same host or
on a different host) are independent agents and cfengine cannot make
promises on their behalf, unless they promise (grant) permission for
cfengine to make the changes. Thus the pre-requisite for making
SQL database promises is to grant a point of access on the server.

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
      databases:
     
       "<var>database</var>/<var>subkey or table</var>"
     
         database_operation =&gt; "<var>create/delete/drop</var>",
         database_type =&gt; "<var>sql/ms_registry</var>",
         database_columns =&gt; {
                             "<var>name</var>,<var>type</var>,<var>size</var>",
                             "<var>name</var>,<var>type</var>",
                             },
     
         database_server =&gt; <var>body</var>;
     
     
      body database_server <var>name</var>
       {
       db_server_owner =&gt; "<var>account name</var>";
       db_server_password =&gt; "<var>password</var>";
       db_server_host =&gt; "<var>hostname or omit for localhost</var>";
       db_server_type =&gt; "<var>mysql/posgres</var>";
       db_server_connection_db =&gt; "<var>database we can connect to</var>";
       }
     
</pre>
   </td></tr></table>

   <p><br>

<pre class="verbatim">
body common control
{
bundlesequence => { "databases" };
}

bundle agent databases

{
#commands:

#  "/usr/bin/createdb cf_topic_maps",

#        contain => as_user("mysql");

databases:

  "cf_topic_maps/topics"

    database_operation => "create",
    database_type => "sql",
    database_columns => { 
                        "topic_name,varchar,256",
                        "topic_comment,varchar,1024",
                        "topic_id,varchar,256",
                        "topic_type,varchar,256",
                        "topic_extra,varchar,26" 
                        },

    database_server => myserver;



}

################################################

body database_server myserver
{
any::
 db_server_owner => "postgres";
 db_server_password => "";
 db_server_host => "localhost";
 db_server_type => "postgres";
 db_server_connection_db => "postgres";
none::
 db_server_owner => "root";
 db_server_password => "";
 db_server_host => "localhost";
 db_server_type => "mysql";
 db_server_connection_db => "mysql";
}

body contain as_user(x)
{
exec_owner => "$(x)";
}
</pre>

   <p><br>

   <p>The promiser in database promises is a concatenation of the database name and underlying tables. 
This presents a simple hierarchical model that looks like a file-system. This is the normal
structure within the Windows registry for instance. Entity-Relation databases do not normally
present tables in this way, but no harm is done in representing them as a hierarchy of depth 1.

<ul class="menu">
<li><a accesskey="1" href="#database_005fserver-in-databases">database_server in databases</a>
<li><a accesskey="2" href="#database_005ftype-in-databases">database_type in databases</a>
<li><a accesskey="3" href="#database_005foperation-in-databases">database_operation in databases</a>
<li><a accesskey="4" href="#database_005fcolumns-in-databases">database_columns in databases</a>
<li><a accesskey="5" href="#database_005frows-in-databases">database_rows in databases</a>
<li><a accesskey="6" href="#registry_005fexclude-in-databases">registry_exclude in databases</a>
</ul>

<div class="node">
<p><hr>
<a name="database_server-in-databases"></a>
<a name="database_005fserver-in-databases"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#database_005ftype-in-databases">database_type in databases</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#databases-in-agent-promises">databases in agent promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#databases-in-agent-promises">databases in agent promises</a>

</div>

<h4 class="subsection">7.2.1 <code>database_server</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>db_server_owner</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: User name for database connection

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     db_server_owner => "mark";
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <br><dt>&lsquo;<samp><code>db_server_password</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Clear text password for database connection

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     db_server_password => "xyz.1234";
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <br><dt>&lsquo;<samp><code>db_server_host</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Hostname or address for connection to database, blank means localhost

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     db_server_host => "sqlserv.example.org";
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Hostname or IP address of the server.

     <br><dt>&lsquo;<samp><code>db_server_type</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>postgres</code>
                    <code>mysql</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: The dialect of the database server

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     db_server_type => "postgres";
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <br><dt>&lsquo;<samp><code>db_server_connection_db</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: The name of an existing database to connect to in order to create/manage other databases

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body database_server myserver(x)
     {
     db_server_owner => "$(x)";
     db_server_password => "";
     db_server_host => "localhost";
     db_server_type => "$(mysql)";
     db_server_connection_db => "$(x)";
     }
     
</pre>

     <p class="noindent">where &lsquo;<samp><span class="samp">x</span></samp>&rsquo; is currently <code>mysql</code> or <code>postgres</code>.

     <p><b>Notes</b>:<br>
<br>

     <p>In order to create a database on a database server (all of which
practice voluntary cooperation), one has to be able to connect
to the server, however, without an existing database this is not allowed. 
Thus, database servers provide a default database that can be connected
to in order to thereafter create new databases. These are called
<code>postgres</code> and <code>mysql</code> for their respective database servers.

     <p>For the knowledge agent, this setting is made in the control body,
for database verification promises, it is made in the
<code>database_server</code> body.

   </dl>

<div class="node">
<p><hr>
<a name="database_type-in-databases"></a>
<a name="database_005ftype-in-databases"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#database_005foperation-in-databases">database_operation in databases</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#database_005fserver-in-databases">database_server in databases</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#databases-in-agent-promises">databases in agent promises</a>

</div>

<h4 class="subsection">7.2.2 <code>database_type</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>sql</code>
               <code>ms_registry</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: The type of database that is to be manipulated

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
database_type => "@var{ms_registry}";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="database_operation-in-databases"></a>
<a name="database_005foperation-in-databases"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#database_005fcolumns-in-databases">database_columns in databases</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#database_005ftype-in-databases">database_type in databases</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#databases-in-agent-promises">databases in agent promises</a>

</div>

<h4 class="subsection">7.2.3 <code>database_operation</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>create</code>
               <code>delete</code>
               <code>drop</code>
               <code>cache</code>
               <code>verify</code>
               <code>restore</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: The nature of the promise - to be or not to be

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
database_operation => "create";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="database_columns-in-databases"></a>
<a name="database_005fcolumns-in-databases"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#database_005frows-in-databases">database_rows in databases</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#database_005foperation-in-databases">database_operation in databases</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#databases-in-agent-promises">databases in agent promises</a>

</div>

<h4 class="subsection">7.2.4 <code>database_columns</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: <code>.*</code>

<p class="noindent"><b>Synopsis</b>: A list of column definitions to be promised by SQL databases

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
  "cf_topic_maps/topics"

    database_operation => "create",
    database_type => "sql",
    database_columns => { 
                        "topic_name,varchar,256",
                        "topic_comment,varchar,1024",
                        "topic_id,varchar,256",
                        "topic_type,varchar,256",
                        "topic_extra,varchar,26" 
                        },

    database_server => myserver;

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Columns are a list of tuplets (<var>Name,type,size</var>). Array items are triplets, and fixed size data elements are doublets.

<div class="node">
<p><hr>
<a name="database_rows-in-databases"></a>
<a name="database_005frows-in-databases"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#registry_005fexclude-in-databases">registry_exclude in databases</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#database_005fcolumns-in-databases">database_columns in databases</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#databases-in-agent-promises">databases in agent promises</a>

</div>

<h4 class="subsection">7.2.5 <code>database_rows</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: <code>.*,.*</code>

<p class="noindent"><b>Synopsis</b>: An ordered list of row values to be promised by SQL databases

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
bundle agent databases

{
databases:

 windows::

  # Regsitry has (value,data) pairs in "keys" which are directories

  "HKEY_LOCAL_MACHINE\SOFTWARE\Cfengine AS\Cfengine"

    database_operation => "create",
    database_rows => { "value1,REG_SZ,new value 1", "value2,REG_SZ,new val 2"} ,
    database_type     => "ms_registry";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This constraint is used only in adding data to database columns. Rows are considered to be
instances of individual columns. In the case of the system registry on Windows, the rows
represent data on data-value pairs.

<div class="node">
<p><hr>
<a name="registry_exclude-in-databases"></a>
<a name="registry_005fexclude-in-databases"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#database_005frows-in-databases">database_rows in databases</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#databases-in-agent-promises">databases in agent promises</a>

</div>

<h4 class="subsection">7.2.6 <code>registry_exclude</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: A list of regular expressions to ignore in key/value verification

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
databases:

 "HKEY_LOCAL_MACHINE\SOFTWARE"

    database_operation => "cache",

    registry_exclude => { ".*Windows.*CurrentVersion.*", 
                          ".*Touchpad.*", ".*Capabilities.FileAssociations.*", 
                          ".*Rfc1766.*" , 
                          ".*Synaptics.SynTP.*", 
                          ".*SupportedDevices.*8086", 
                          ".*Microsoft.*ErrorThresholds" 
                        },

    database_type     => "ms_registry";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>During recursive Windows registry scanning, this option allows us to ignore keys of values matching a
list of regular expressions. Some values in the registry are ephemeral and some should not be considered. 
This provdes a convenient way of avoiding names. It is analogous to <code>exclude_dirs</code> for files.

<div class="node">
<p><hr>
<a name="files-in-agent-promises"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#delete_005flines-in-edit_005fline-promises">delete_lines in edit_line promises</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#databases-in-agent-promises">databases in agent promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-agent">Bundles for agent</a>

</div>

<h3 class="section">7.3 <code>files</code> promises in &lsquo;<samp><span class="samp">agent</span></samp>&rsquo;</h3>

<p><br>

   <p>Files promises are an umbrella concept for all attributes of files. 
Operations fall basically into three categories: create, delete and
edit.

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
      files:
     
        "<var>/path/file_object</var>"
     
            perms =&gt; <var>perms_body</var>,
            ... ;
     
</pre>
   </td></tr></table>

   <p>Prior to version 3, file promises were scattered into many different
types such as <code>files</code>, <code>tidy</code>, <code>copy</code>, <code>links</code>,
etc.  File handling in cfengine 3 uses regular expressions everywhere for pattern
matching. The old `wildcard/globbing' expressions &lsquo;<samp><span class="samp">*</span></samp>&rsquo; and
&lsquo;<samp><span class="samp">?</span></samp>&rsquo;  are deprecated, and everything is based consistently on Perl
Compatible Regular Expressions where these are available. If PCRE is
not available on the local system, POSIX extended regular expressions
are used.

   <p>There is a natural ordering in file processing that obviates the need
for the actionsequence. The trick of using multiple actionsequence
items with different classes, e.g.

<pre class="verbatim"> actionsequence = ( ... files.one  ..  files.two )
</pre>

   <p>can now be handled more elegantly using bundles. The natural ordering
uses that fact that some operations are mutually exclusive and that
some operations do not make sense in reverse order. For example,
editing a file and then copying onto it would be nonsense. 
Similarly, you cannot both remove a file and rename it.

<p class="noindent"><b>File copying</b>

   <p>One of the first things users of cfengine 2 will notice is that copying is now `backwards'. 
Instead of the default object being source and the option being the destination,
in cfengine 3 the destination is paramount and the source is an option. 
This is because the model of voluntary cooperation tells us that it is the
object that is changed which is the agent making the promise. One cannot
force change onto a destination with cfengine, one can only invite change from
a source.

<p class="noindent"><b>Normal ordering</b>

   <p>Cfengine 3 no longer has an `action sequence'. Ordering of operations has,
in most cases, a natural ordering which is assumed by the agent. For instance:
`delete then create' (normal ordering) makes sense, but
`create then delete' does not. This sort of principle can be extended to
deal with all aspects of file promises.

   <p>The diagram below shows the ordering. Notice that the same ordering
applies regardless of file type (plain-file or directory).

   <div class="block-image"><img src="filelogic.png" alt="The normal ordering of file operators in cfengine 3"></div>

   <p>The pseudo-code for this logic is shown in the diagram and below:

<pre class="verbatim"> for each file promise-object
    {
    if (depth_search) 

      do 
        DepthSearch (HandleLeaf)
      else 
        (HandleLeaf)
      done
    }

 HandleLeaf()
   {
   Does leaf-file exist?

     NO:  create
     YES: rename,delete,touch, 

     do
      for all servers in {localhost, @(servers)}
         {
         if (server-will-provide)
            do
              if (depth_search)
                 embedded source-depth-search (use file source)
                 break
              else
                 (use file source)
                 break
              done
            done
         }
     done
      
   Do all links (always local)

   Check Permissions

   Do edits
   }

</pre>

<p class="noindent"><b>Depth searches (recursion) during searches</b>

   <p>In cfengine 2 there was the concept of recursion during file
searches. Recursion is now called "depth-search". 
In addition, it was possible to specify
wildcards in the base-path for this search. Cfengine 3 replaces
the `globbing' symbols with standard regular expressions:

<pre class="verbatim">
      Cfengine 2               Cfengine 3

/one/*/two/thr*/four    /one/.*/two/thr.*/four

</pre>

   <p>When we talk about a depth search, it refers to a search for file
objects which starts from the one or more matched base-paths as shown
in the example above.

<p class="noindent"><b>Local and remote searches</b>

   <p>There are two distinct kinds of depth
search:

     <ul>
<li>A local search over promiser agents. 
<li>A remote search over provider agents. 
</ul>

   <p>When we are <i>copying</i> or <i>linking</i> to a file source, it is the search over
the <i>remote</i> source that drives the content of a promise (the
promise is a promise to use what the remote source provides). In
general, the sources are on a different device to the images that make
the promises.  For all other promises, we search over existing local
objects.

   <p>If we specify depth search together with copy of a directory, then the
implied remote source search is assumed, and it is made after the
search over local base-path objects has been made. If you mix complex
promise body operations in a single prmose, this could lead to
confusion about the resulting behaviour, and a warning is issued. In
general it is not recommended to mix searches without a full
understanding of the consequences, but this might occasionally be
useful.

   <p>Depth search is not allowed with editfiles promises.

<p class="noindent"><b>File editing in cfengine 3</b>

   <p>Cfengine 2 assumed that all files were line-edited, because it was
based on Unix traditions. Since then many new file formats have
emerged, including XML.  Cfengine 3 opens up the possibiltiy for
multiple models of file editing. Line based editing is still present and
is both much simplified and much more powerful than previously.

   <p>File editing is not just a single kind of promise but a whole range of
`promises within files'. It is therefore not merely a body to a single kind of
promise, but a bundle of sub-promises. After all, inside each file is a new
world of objects that can make promises, quite separate from files' external
attributes.

   <p>A typical file editing stanza has the elements in the following
example.

<pre class="verbatim">######################################################################
#
# File editing
#
######################################################################

body common control

{
version => "1.2.3";
bundlesequence  => { "outerbundle"  };
}

########################################################

bundle agent outerbundle

{
files:

  "/home/mark/tmp/cf3_test"

       create    => "true",     # Like autocreate in cf2
       edit_line => inner_bundle;
}

########################################################

bundle edit_line inner_bundle
  {
  vars:

   "edit_variable" string => "private edit variable"; 
  
  replace_patterns:

   # replace shell comments with C comments

   "#(.*)"

      replace_with => C_comment,
     select_region => MySection("New section");

  reports:

    someclass::

      "This is file $(edit.filename)"
  }

########################################
# Bodies for the library ...
########################################

body replace_with C_comment

{
replace_value => "/* $(1) */"; # backreference 0
occurrences => "all";          # first, last all
}

########################################################

body select_region MySection(x)

{
select_start => "\[$(x)\]";
select_end => "\[.*\]";
}

</pre>

<p class="noindent">There are several things to notice:

     <ul>
<li>The line-editing promises are all convergent promises about patterns within
the file. They have bodies, just like other attributes do and these allow us to make
simple templates about file editing while extending the power of the basic primitives.

     <li>All pattern matching is through perl compatible regular expressions
<li>Editing takes place within a marked region (which defaults to the whole file). 
<li>Search/replace functions now allow back-references. 
<li>The line edit model now contains a field or column model for dealing with tabular files such
as Unix <samp><span class="file">passwd</span></samp> and <samp><span class="file">group</span></samp> files. We can now apply powerful convergent editing operations
to single fields inside a table, to append, order and delete items from lists inside fields.

     <li>The special variable <code>$(edit.filename)</code> contains the name of the file being edited within
an edit bundle. 
</ul>

<p class="noindent">In the example above, back references are used to allow conversion of comments from shell-style
to C-style.

   <p><br>

<pre class="verbatim">
bundle agent example
{
files:

  "/home/mark/tmp" -> "Security team"

       changes      => lay_a_tripwire,
       depth_search => recurse("inf"),
       action       => background;
}

#########################################################

body changes lay_a_tripwire

{
hash           => "md5";
report_changes => "content";
update         => "yes";
}

</pre>

   <p><br>

<ul class="menu">
<li><a accesskey="1" href="#acl-in-files">acl in files</a>
<li><a accesskey="2" href="#changes-in-files">changes in files</a>
<li><a accesskey="3" href="#copy_005ffrom-in-files">copy_from in files</a>
<li><a accesskey="4" href="#create-in-files">create in files</a>
<li><a accesskey="5" href="#delete-in-files">delete in files</a>
<li><a accesskey="6" href="#depth_005fsearch-in-files">depth_search in files</a>
<li><a accesskey="7" href="#edit_005fline-in-files">edit_line in files</a>
<li><a accesskey="8" href="#edit_005fxml-in-files">edit_xml in files</a>
<li><a accesskey="9" href="#edit_005fdefaults-in-files">edit_defaults in files</a>
<li><a href="#file_005fselect-in-files">file_select in files</a>
<li><a href="#link_005ffrom-in-files">link_from in files</a>
<li><a href="#move_005fobstructions-in-files">move_obstructions in files</a>
<li><a href="#pathtype-in-files">pathtype in files</a>
<li><a href="#perms-in-files">perms in files</a>
<li><a href="#rename-in-files">rename in files</a>
<li><a href="#repository-in-files">repository in files</a>
<li><a href="#touch-in-files">touch in files</a>
<li><a href="#transformer-in-files">transformer in files</a>
</ul>

<div class="node">
<p><hr>
<a name="acl-in-files"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#changes-in-files">changes in files</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#files-in-agent-promises">files in agent promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#files-in-agent-promises">files in agent promises</a>

</div>

<h4 class="subsection">7.3.1 <code>acl</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>aces</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>((user|group):[^:]+:[-=+,rwx()]*(:(allow|deny))?)|((all|mask):[-=+,rwx()]*(:(allow|deny))?)</code>

     <p class="noindent"><b>Synopsis</b>: Native settings for access control entry

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body acl template
     
     {
     acl_method => "overwrite";
     acl_type => "posix";
     acl_directory_inherit => "parent";
     
     aces => { 
             "user:*:r(wwx),-r:allow", 
             "group:*:+rw:allow", 
             "mask:x:allow", 
             "all:r"
             };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Form of the
permissions is:

     <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
     <pre class="smallexample">                aces =&gt; {
                        "<var>user:uid:mode[:perm_type]</var>", ...,
                        "<var>group:gid:mode[:perm_type]</var>", ...,
                        "<var>all:mode[:perm_type]</var>"
                        };
</pre>
     </td></tr></table>

          <ul>
<li><code>user</code> indicates that the line applies to a user specified
  by the user identitfier <code>uid</code>. <code>mode</code> is the permission
  mode string.

          <li><code>group</code> indicates that the line applies to a group specified
  by the group identitfier <code>gid</code>. <code>mode</code> is the permission
  mode string.

          <li><code>all</code> indicates that the line applies to every
  user. <code>mode</code> is the permission mode string.

          <li><code>uid</code> is a valid user identifier for the system and
  cannot be empty. However, <code>uid</code> can be set to * as a synonym
  for the entity that owns the file system object (e.g. user:*:r).

          <li><code>gid</code> is a valid group identifier for the system and
  cannot be empty. However, in some acl types, <code>gid</code> can be set
  to * to indicate a special group (e.g. in POSIX this refers to the
  file group).

          <li><code>mode</code> is one or more strings
  <code>op</code>|<code>perms</code>|(<code>nperms</code>); a concatenation of <code>op</code>,
  <code>perms</code> and optionally (<code>nperms</code>), see below, separated
  with commas (e.g. +rx,-w(s)). <code>mode</code> is parsed from left to
  right. 
<!-- TODO: include support for @code{fullaccess}, @code{noaccess}, -->
<!-- and @code{remove} -->

          <li><code>op</code> specifies the operation on any existing permissions,
  if the defined ACE already exists. <code>op</code> can be =, empty, + or
  -. = or empty sets the permissions to the ACE as stated, + adds and
  - removes the permissions from any existing ACE. 
  <!-- TODO: what to do if + or - is used when ACE does not exist? -->

          <li><code>nperms</code> (optional) specifies file system specific
  (native) permissions. Only valid if <code>acl_type</code> is
  defined. <code>nperms</code> will only be enforced if the file object is
  stored on a file system supporting the acl type set in
  <code>acl_type</code> (e.g. <code>nperms</code> will be ignored if
  <code>acl_type:</code><code>ntfs</code> and the object is stored on a file system
  not supporting ntfs ACLs). Valid values for <code>nperms</code> varies with
  different ACL types, and is defined in subsequent sections.

          <li><code>perm_type</code> (optional) can be set to either <code>allow</code> or
  <code>deny</code>, and defaults to <code>allow</code>. <code>deny</code> is only valid
  if <code>acl_type</code> is set to an ACL type that support deny
  permissions. A <code>deny</code> ACE will only be enforced if the file
  object is stored on a file system supporting the acl type set in
  <code>acl_type</code>. 
</ul>

     <p><code>gperms</code> (generic permissions) is a concatenation of zero or more
of the characters shown in the table below. If left empty,
none of the permissions are set. 
<!-- TODO: Should be allowed to set no permissions (empty perms?) -->

     <p><table summary=""><tr align="left"><th valign="top" width="5%">Flag </th><th valign="top" width="20%">Description </th><th valign="top" width="30%">Semantics on file </th><th valign="top" width="35%">Semantics on directory

     <p><br></th></tr><tr align="left"><td valign="top" width="5%"><code>r</code> </td><td valign="top" width="20%">Read </td><td valign="top" width="30%">Read data, permissions, attributes </td><td valign="top" width="35%">Read
directory contents, permissions, attributes
<br></td></tr><tr align="left"><td valign="top" width="5%"><code>w</code> </td><td valign="top" width="20%">Write </td><td valign="top" width="30%">Write data </td><td valign="top" width="35%">Create, delete, rename subobjects
<br></td></tr><tr align="left"><td valign="top" width="5%"><code>x</code> </td><td valign="top" width="20%">Execute </td><td valign="top" width="30%">Execute file </td><td valign="top" width="35%">Access subobjects
     <br></td></tr></table>

     <p>Note that the <code>r</code> permission is not neccessary to read an object's
permissions and attributes in all file systems (e.g. in POSIX, having
<code>x</code> on its containing directory is sufficient).

     <br><dt>&lsquo;<samp><code>acl_directory_inherit</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>parent</code>
                    <code>specify</code>
                    <code>none</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Access control list type for the affected file system

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body acl template
     
     {
     acl_method => "overwrite";
     acl_type => "posix";
     acl_directory_inherit => "parent";
     
     aces => { 
             "user:*:r(wwx),-r:allow", 
             "group:*:+rw:allow", 
             "mask:x:allow", 
             "all:r"
             };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Directories have ACLs associated with them, but they also have the
ability to inherit an ACL to sub-objects created within them. POSIX
calls the former ACL type "access ACL" and the latter "default ACL",
and we will use the same terminology.

     <p>In some file systems, like NTFS, objects can only inherit the access
ACL of the parent directory (or nothing). There are also differences
in what is inherited by default. In POSIX, the default ACL is usually
unset, which results in no ACL inheritance, while NTFS always inherits
the access ACL to subobjects.

     <br><dt>&lsquo;<samp><code>acl_method</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>append</code>
                    <code>overwrite</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Editing method for access control list

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body acl template
     
     {
     acl_method => "overwrite";
     acl_type => "posix";
     acl_directory_inherit => "parent";
     aces => { "user:*:r(wwx),-r:allow", "group:*:+rw:allow", "mask:x:allow", "all:r"};
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <br><dt>&lsquo;<samp><code>acl_type</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>generic</code>
                    <code>posix</code>
                    <code>ntfs</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Access control list type for the affected file system

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body acl template
     
     {
     acl_method => "overwrite";
     acl_type => "posix";
     acl_directory_inherit => "parent";
     aces => { "user:*:r(wwx),-r:allow", "group:*:+rw:allow", "mask:x:allow", "all:r"};
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <br><dt>&lsquo;<samp><code>specify_inherit_aces</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>((user|group):[^:]+:[-=+,rwx()]*(:(allow|deny))?)|((all|mask):[-=+,rwx()]*(:(allow|deny))?)</code>

     <p class="noindent"><b>Synopsis</b>: Native settings for access control entry

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     body acl template
     {
     specify_inherit_aces => {  "all:r" };
     }
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p><code>specify_inherit_aces</code> (optional) is a list of access control
  entries that are set on child objects. It is also parsed from left
  to right and allows multiple entries with same entity-type and
  id. Only valid if <code>acl_directory_inherit</code> is set to
  <code>specify</code>.

     <p>This is an acl which makes explicit setting for the acl inherited by
new objects within a directory. It is included for those implementations
that do not have a clear inheritance policy.

   </dl>

<div class="node">
<p><hr>
<a name="changes-in-files"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#copy_005ffrom-in-files">copy_from in files</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#acl-in-files">acl in files</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#files-in-agent-promises">files in agent promises</a>

</div>

<h4 class="subsection">7.3.2 <code>changes</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>hash</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>md5</code>
                    <code>sha1</code>
                    <code>best</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Hash files for change detection

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body changes example
     {
     hash => "md5";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The <code>best</code> option cross correlates the best two available
algorithms known in the OpenSSL library.

     <br><dt>&lsquo;<samp><code>report_changes</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>all</code>
                    <code>stats</code>
                    <code>content</code>
                    <code>none</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Specify criteria for change warnings

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body changes example
     {
     report_changes => "content";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Files can change in permissions and contents, i.e. external or internal attributes. 
If &lsquo;<samp><span class="samp">all</span></samp>&rsquo; is chosen all attributes are checked.

     <br><dt>&lsquo;<samp><code>update_hashes</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Update hash values immediately after change warning

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body changes example
     {
     update_hashes => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>If this is positive, file hashes should be updated as soon as a change
is registered so that multiple warnings are not given about a single
change. This applies to addition and removal too.

   </dl>

<div class="node">
<p><hr>
<a name="copy_from-in-files"></a>
<a name="copy_005ffrom-in-files"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#create-in-files">create in files</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#changes-in-files">changes in files</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#files-in-agent-promises">files in agent promises</a>

</div>

<h4 class="subsection">7.3.3 <code>copy_from</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>source</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

     <p class="noindent"><b>Synopsis</b>: Reference source file from which to copy

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from example
     {
     source => "/path/to/source";
     }
     
     # or
     
     body link_from example
     {
     source => "/path/to/source";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>For remote copies this refers to the file name on the remote server.

     <br><dt>&lsquo;<samp><code>servers</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>[A-Za-z0-9_.:-]+</code>

     <p class="noindent"><b>Synopsis</b>: List of servers in order of preference from which to copy

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from example
     {
     servers => { "primary.example.org", "secondary.example.org", 
                      "tertiary.other.domain" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The servers are tried in order until one of them succeeds.

     <br><dt>&lsquo;<samp><code>collapse_destination_dir</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false Place files in subdirectories into the root destination directory during copy

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from mycopy(from,server)
     
     {
     source      => "$(from)";
     servers     => { "$(server)" };
     collapse_destination_dir => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Under normal operations, recursive copies cause cfengine to track subdirectories
of files. So, for instance, if we copy recurively from <samp><span class="file">src</span></samp> to <samp><span class="file">dest</span></samp>,
then <samp><span class="file">src/subdir/file</span></samp> will map to <samp><span class="file">dest/subdir/file</span></samp>.

     <p>By setting this option to &lsquo;<samp><span class="samp">true</span></samp>&rsquo;, the promiser destination
directory promises to aggregate files searched from all subdirectories
into itself, i.e. a single destination directory.

     <br><dt>&lsquo;<samp><code>compare</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>atime</code>
                    <code>mtime</code>
                    <code>ctime</code>
                    <code>digest</code>
                    <code>hash</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Menu option policy for comparing source and image file attributes

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from example
     
     {
     compare => "digest";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The default copy method is &lsquo;<samp><span class="samp">mtime</span></samp>&rsquo; (modification time), meaning that
the source file is copied to the destination (promiser) file, if the
source file has been modified more recently than the destination.

     <br><dt>&lsquo;<samp><code>copy_backup</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>timestamp</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Menu option policy for file backup/version control

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from example
     {
     copy_backup => "timestamp";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Determines whether a backup of the previous version is kept on the
system. This should be viewed in connection with the system repository,
since a defined repository affects the location at which the backup
is stored.

     <br><dt>&lsquo;<samp><code>encrypt</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false use encrypted data stream to connect to remote host

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from example
     {
     servers  => { "remote-host.example.org" };
     encrypt => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Client connections are encrypted with using a Blowfish randomly
generated session key.  The intial connection is encrypted using the
public/private keys for the client and server hosts.

     <br><dt>&lsquo;<samp><code>check_root</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false check permissions on the root directory when depth_search

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from example
     {
     check_root => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>When copying files recursively (by depth search), this flag determines
whether the permissions of the root directory should be set from the
root of the source. The default is to check only copied file objects
and subdirectories within this root (false).

     <br><dt>&lsquo;<samp><code>copylink_patterns</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: List of patterns matching files that should be linked instead of copied

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from example
     {
     copylink_patterns => { "special_node1", "other_node.*" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The matches are performed on the last node of the filename, i.e.  the
file without its path.

     <br><dt>&lsquo;<samp><code>copy_size</code></samp>&rsquo;<dd><b>Type</b>: irange [int,int]

     <p class="noindent"><b>Allowed input range</b>: <code>0,inf</code>

     <p class="noindent"><b>Synopsis</b>: Integer range of file sizes that may be copied

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from example
     {
     copy_size => irange("0","50000");
     } 
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The use of the irange function is optional. Ranges may also be
specified as a comma separated numbers.

     <br><dt>&lsquo;<samp><code>findertype</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>MacOSX</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Menu option for default finder type on MacOSX

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from example
     {
     findertype => "MacOSX";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This applies only to the Macintosh OSX variants.

     <br><dt>&lsquo;<samp><code>linkcopy_patterns</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: List of patterns matching symbolic links that should be replaced with copies

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from mycopy(from)
     
     {
     source            => "$(from)";
     linkcopy_patterns => { ".*" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The pattern matches the last node filename (i.e. without the absolute path).

     <br><dt>&lsquo;<samp><code>link_type</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>symlink</code>
                    <code>hardlink</code>
                    <code>relative</code>
                    <code>absolute</code>
                    <code>none</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Menu option for type of links to use when copying

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body link_from example
     {
     link_type => "hard";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>What kind of link should be used to link files. Users are advised to
be wary of `hard links' (see Unix manual pages for the &lsquo;<samp><span class="samp">ln</span></samp>&rsquo;
command). The behaviour of non-symbolic links is often precarious and
unpredictable.

     <br><dt>&lsquo;<samp><code>force_update</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false force copy update always

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from example
     {
     force_update => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Warning: this is a non-convergent operation. Although the end point
might stabilize in content, the operation will never quiesce. Use of
this feature is not recommended except in exceptional circumstances
since it creates a busy-dependency. If the copy is a network copy,
the system will be disturbed by network disruptions.

     <br><dt>&lsquo;<samp><code>force_ipv4</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false force use of ipv4 on ipv6 enabled network

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from example
     {
     force_ipv4 => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>IPv6 should be harmless to most users unless you have a partially
or misconfigured setup.

     <br><dt>&lsquo;<samp><code>portnumber</code></samp>&rsquo;<dd><b>Type</b>: int

     <p class="noindent"><b>Allowed input range</b>: <code>1024,99999</code>

     <p class="noindent"><b>Synopsis</b>: Port number to connect to on server host

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from example
     {
     portnumber => "5308";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The standard or registered port number is tcp/5308. Cfengine does not
presently use its registered udp port with the same number, but this
could change in the future.

     <br><dt>&lsquo;<samp><code>preserve</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false whether to preserve file permissions on copied file

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from example
     {
     preserve => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Whether or not the copy preserves the permissions on the source files.

     <br><dt>&lsquo;<samp><code>purge</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false purge files on client that do not match files on server when depth_search

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from example
     {
     purge => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Purging files is a potentially dangerous matter during a file copy it
implies that any promiser (destination) file which is not matched by a
source will be deleted. Since there is no source, this means the file
will be irretrievable. Great care should be exercised when using this
feature.

     <p>Note that purging will also delete backup files generated during
the file copying if <code>copy_backup</code> is set to true.

     <br><dt>&lsquo;<samp><code>stealth</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false whether to preserve time stamps on copied file

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from example
     {
     stealth => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Preserves file access and modification times on the promiser files.

     <br><dt>&lsquo;<samp><code>trustkey</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false trust public keys from remote server if previously unknown

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from example
     {
     trustkey => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>If the server's public key has not already been trusted, this
allows us to accept the key in automated key-exchange.

     <p>Note that, as a simple security precaution, trustkey should normally
be set to &lsquo;<samp><span class="samp">false</span></samp>&rsquo;, to avoid key exchange with a server one is not
one hundred percent sure about, though the risks for a client are
rather low. On the server-side however, trust is often granted to
many clients or to a whole network in which possibly unauthorized
parties might be able to obtain an IP address, thus the trust issue
is most important on the server side.

     <p>As soon as a public key has been exchanged, the trust option has no
effect. A machine that has been trusted remains trusted until
its key is manually revoked by a system administrator. Keys are
stored in <samp><span class="file">WORKDIR/ppkeys</span></samp>.

     <br><dt>&lsquo;<samp><code>type_check</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false compare file types before copying and require match

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from example
     {
     type_check => "false";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>File types at source and destination should normally match in order for
updates to overwrite them. This option allows this checking to be switched off.

     <br><dt>&lsquo;<samp><code>verify</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false verify transferred file by hashing after copy (resource penalty)

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from example
     {
     verify => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This is a highly resource intensive option, not recommended
for large file transfers.

   </dl>

<div class="node">
<p><hr>
<a name="create-in-files"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#delete-in-files">delete in files</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#copy_005ffrom-in-files">copy_from in files</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#files-in-agent-promises">files in agent promises</a>

</div>

<h4 class="subsection">7.3.4 <code>create</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false whether to create non-existing file

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
files:

  "/path/plain_file"

     create =>   "true";

  "/path/dir/."
  
     create =>   "true";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Directories are created by using the &lsquo;<samp><span class="samp">/.</span></samp>&rsquo; to signify a directory type. 
Note that, if no permissions are specified, mode 600 is chosen for a file,
and mode 755 is chosen for a directory. If you cannot accept these defaults,
you <i>should</i> specify permissions.

<div class="node">
<p><hr>
<a name="delete-in-files"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#depth_005fsearch-in-files">depth_search in files</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#create-in-files">create in files</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#files-in-agent-promises">files in agent promises</a>

</div>

<h4 class="subsection">7.3.5 <code>delete</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>dirlinks</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>delete</code>
                    <code>tidy</code>
                    <code>keep</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Menu option policy for dealing with symbolic links to directories during deletion

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body delete example
     {
     dirlinks => "keep";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Links to directories are normally removed just like any other link or
file objects. By keeping directory links, you preserve the logical
directory structure of the file system.

     <br><dt>&lsquo;<samp><code>rmdirs</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false whether to delete empty directories during recursive deletion

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body delete example
     {
     rmdirs => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>When deleting files recursively from a base directory, should we
delete empty directories also, or keep the directory structure intact?

     <p>Note the parent directory of a search is not deleted in recursive
deletions.  In cfengine 2 there was an option to delete the parent of
the search, but now in cfengine 3, you must code a separate promise to
delete the single parent object.

     <pre class="verbatim">     
     files:
     
       # This will not delete the parent
     
       "/home/mark/tmp/testcopy" 
     
         delete => tidyfiles,
         file_select => zero_age, # has rmdirs true
         depth_search => recurse("inf");
     
       # Now delete the parent.
     
       "/home/mark/tmp/testcopy" 
         delete => tidyfiles;
     
</pre>

   </dl>

<div class="node">
<p><hr>
<a name="depth_search-in-files"></a>
<a name="depth_005fsearch-in-files"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#edit_005fline-in-files">edit_line in files</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#delete-in-files">delete in files</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#files-in-agent-promises">files in agent promises</a>

</div>

<h4 class="subsection">7.3.6 <code>depth_search</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>depth</code></samp>&rsquo;<dd><b>Type</b>: int

     <p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

     <p class="noindent"><b>Synopsis</b>: Maximum depth level for search

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body depth_search example
     {
     depth => "inf";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This was previous called `recurse' in earlier versions of cfengine. 
Note that the value &lsquo;<samp><span class="samp">inf</span></samp>&rsquo; may be used for an unlimited value.

     <p>When searching recursively from a directory, the parent directory is
not part of the search. It is only the anchor point. To alter the parent,
a separate non-recursive promise should be made.

     <br><dt>&lsquo;<samp><code>exclude_dirs</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: List of regexes of directory names NOT to include in depth search

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body depth_search
     {
     # no dot directories
     exclude_dirs => { "\..*" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Directory names are treated specially when searching recursively through a
file system.

     <br><dt>&lsquo;<samp><code>include_basedir</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false include the start/root dir of the search results

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body depth_search example
     {
     include_basedir => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>When checking files recursively (with <code>depth_search</code>) the promiser
is a directory. This parameter determines whether that initial directory
should be considered part of the promise or simply a boundary which marks
the edge of the search. If true, the promiser directory will also promise
the same attributes as the files inside it.

     <br><dt>&lsquo;<samp><code>include_dirs</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: List of regexes of directory names to include in depth search

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body depth_search example
     {
     include_dirs => { "subdir1", "subdir2", "pattern.*" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This is the complement of <code>exclude_dirs</code>.

     <br><dt>&lsquo;<samp><code>rmdeadlinks</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false remove links that point to nowhere

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body depth_search example
     {
     rmdeadlinks => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>If we find links that point to non-existence files, should we delete them or keep them?

     <br><dt>&lsquo;<samp><code>traverse_links</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false traverse symbolic links to directories (false)

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body depth_search example
     {
     traverse_links => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>If this is true, <code>cf-agent</code> will treat symbolic links to
directories as if they were directories. Normally this is considered a
potentially dangerous assumption and links are not traversed.

     <br><dt>&lsquo;<samp><code>xdev</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false exclude directories that are on different devices

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body depth_search example
     {
     xdev => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

   </dl>

<div class="node">
<p><hr>
<a name="edit_line-in-files"></a>
<a name="edit_005fline-in-files"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#edit_005fxml-in-files">edit_xml in files</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#depth_005fsearch-in-files">depth_search in files</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#files-in-agent-promises">files in agent promises</a>

</div>

<h4 class="subsection">7.3.7 <code>edit_line</code></h4>

<p><b>Type</b>: (ext bundle) (Separate Bundle)

<div class="node">
<p><hr>
<a name="edit_xml-in-files"></a>
<a name="edit_005fxml-in-files"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#edit_005fdefaults-in-files">edit_defaults in files</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#edit_005fline-in-files">edit_line in files</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#files-in-agent-promises">files in agent promises</a>

</div>

<h4 class="subsection">7.3.8 <code>edit_xml</code></h4>

<p><b>Type</b>: (ext bundle) (Separate Bundle)

<div class="node">
<p><hr>
<a name="edit_defaults-in-files"></a>
<a name="edit_005fdefaults-in-files"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#file_005fselect-in-files">file_select in files</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#edit_005fxml-in-files">edit_xml in files</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#files-in-agent-promises">files in agent promises</a>

</div>

<h4 class="subsection">7.3.9 <code>edit_defaults</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>edit_backup</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>timestamp</code>
                    <code>rotate</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Menu option for backup policy on edit changes

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body edit_defaults example
     {
     edit_backup => "timestamp";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <br><dt>&lsquo;<samp><code>empty_file_before_editing</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Baseline memory model of file to zero/empty before commencing promised edits

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body edit_defaults example
     {
     empty_file_before_editing => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Emptying a file before reconstructing its contents according to a
fixed recipe allows an ordered procedure to be convergent.

     <br><dt>&lsquo;<samp><code>max_file_size</code></samp>&rsquo;<dd><b>Type</b>: int

     <p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

     <p class="noindent"><b>Synopsis</b>: Do not edit files bigger than this number of bytes

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body edit_defaults example
     {
     max_file_size => "50K";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>A local, per-file sanity check to make sure the file editing is sensible. 
If this is set to zero, the check is disabled and any size may be edited.

   </dl>

<div class="node">
<p><hr>
<a name="file_select-in-files"></a>
<a name="file_005fselect-in-files"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#link_005ffrom-in-files">link_from in files</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#edit_005fdefaults-in-files">edit_defaults in files</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#files-in-agent-promises">files in agent promises</a>

</div>

<h4 class="subsection">7.3.10 <code>file_select</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>leaf_name</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: List of regexes that match an acceptable name

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body file_select example
     {
     leaf_name => { "S[0-9]+[a-zA-Z]+", "K[0-9]+[a-zA-Z]+" };
     file_result => "leaf_name";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This pattern matches only the node name of the file, not its path.

     <br><dt>&lsquo;<samp><code>path_name</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

     <p class="noindent"><b>Synopsis</b>: List of pathnames to match acceptable target

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body file_select example
     {
     leaf_name => { "prog.pid", "prog.log" };
     path_name => { "/etc/.*", "/var/run/.*" };
     
     file_result => "leaf_name.path_name"
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Path name and leaf name can be conveniently tested for separately by use
of appropriate regular expressions.

     <br><dt>&lsquo;<samp><code>search_mode</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>[0-7augorwxst,+-]+</code>

     <p class="noindent"><b>Synopsis</b>: A list of mode masks for acceptable file permissions

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     #######################################################
     #
     # Searching for permissions
     #
     #######################################################
     
     body common control
        {
        any::
     
           bundlesequence  => { 
                              "testbundle"
                              };
     
        version => "1.2.3";
        }
     
     ############################################
     
     bundle agent testbundle
     
     {
     files:
     
       "/home/mark/tmp/testcopy" 
     
         file_select => by_modes,
         transformer => "/bin/echo DETECTED $(this.promiser)",
         depth_search => recurse("inf");
     
     }
     
     ############################################
     
     body file_select by_modes
     
     {
     search_mode => { "711" , "666" };
     file_result => "mode";
     }
     
     ############################################
     
     body depth_search recurse(d)
     
     {
     depth => "$(d)";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The mode may be specified in symbolic or numerical form with &lsquo;<samp><span class="samp">+</span></samp>&rsquo;
and &lsquo;<samp><span class="samp">-</span></samp>&rsquo; constraints. 
Note that concatenation <code>ug+s</code> implies <code>u</code> OR <code>g</code>,
 and <code>u+g,u+s</code> implies <code>u</code> AND <code>g</code>.

     <br><dt>&lsquo;<samp><code>search_size</code></samp>&rsquo;<dd><b>Type</b>: irange [int,int]

     <p class="noindent"><b>Allowed input range</b>: <code>0,inf</code>

     <p class="noindent"><b>Synopsis</b>: Integer range of file sizes

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body file_select example
     {
     search_size => irange("0","20k");
     file_result => "size";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <br><dt>&lsquo;<samp><code>search_owners</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: List of acceptable user names or ids for the file, or regexes to match

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body file_select example
     {
     search_owners => { "mark", "jeang", "student_.*" };
     file_result => "owner";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>A list of regular expressions.

     <br><dt>&lsquo;<samp><code>search_groups</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: List of acceptable group names or ids for the file, or regexes to match

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body file_select example
     {
     search_groups => { "users", "special_.*" };
     file_result => "group";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <br><dt>&lsquo;<samp><code>search_bsdflags</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>[+-]*[(arch|archived|nodump|opaque|sappnd|sappend|schg|schange|simmutable|sunlnk|sunlink|uappnd|uappend|uchg|uchange|uimmutable|uunlnk|uunlink)]+</code>

     <p class="noindent"><b>Synopsis</b>: String of flags for bsd file system flags expected set

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body file_select xyz
     {
     search_bsdflags => "archived|dump";
     file_result => "bsdflags";
     }
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Extra BSD file system flags.

     <br><dt>&lsquo;<samp><code>ctime</code></samp>&rsquo;<dd><b>Type</b>: irange [int,int]

     <p class="noindent"><b>Allowed input range</b>: <code>0,2147483647</code>

     <p class="noindent"><b>Synopsis</b>: Range of change times (ctime) for acceptable files

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body files_select example
     {
     ctime => irange(ago(1,0,0,0,0,0),now);
     file_result => "ctime";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The file's change time refers to both modification of content and attributes
such as permissions.

     <br><dt>&lsquo;<samp><code>mtime</code></samp>&rsquo;<dd><b>Type</b>: irange [int,int]

     <p class="noindent"><b>Allowed input range</b>: <code>0,2147483647</code>

     <p class="noindent"><b>Synopsis</b>: Range of modification times (mtime) for acceptable files

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body files_select example
     {
     mtime => irange(ago(1,0,0,0,0,0),now);
     file_result => "mtime";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The file's modification time refers to both modification of content but not other attributes
such as permissions.

     <br><dt>&lsquo;<samp><code>atime</code></samp>&rsquo;<dd><b>Type</b>: irange [int,int]

     <p class="noindent"><b>Allowed input range</b>: <code>0,2147483647</code>

     <p class="noindent"><b>Synopsis</b>: Range of access times (atime) for acceptable files

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     body file_select 
     
     {
     # files accessed in the last hour
     
     atime     => irange(ago(0,0,0,1,0,0),now);
     file_result => "atime";
     }
     
     
     body file_select 
     
     {
     # files accessed since 00:00 1st Jan 2000
     
     atime     => irange(on(2000,1,1,0,0,0),now);
     file_result => "atime";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>A range of times during which a file was accessed can be specified in
a <code>file_select</code> body. (Like file filters in cfengine 2.)

     <br><dt>&lsquo;<samp><code>exec_regex</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

     <p class="noindent"><b>Synopsis</b>: Matches file if this regular expression matches any full line returned by the command

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body file_select example
     {
     exec_regex => "SPECIAL_LINE: .*";
     exec_program => "/path/test_program $(this.promiser)";
     file_result => "exec_program.exec_regex";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The regular expression must be used in conjuection with the <code>exec_program</code> test. 
In this way the program must both return exit status 0 and its
output must match the regular expression.

     <br><dt>&lsquo;<samp><code>exec_program</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

     <p class="noindent"><b>Synopsis</b>: Execute this command on each file and match if the exit status is zero

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body file_select example
     {
     exec_program => "/path/test_program $(this.promiser)";
     file_result => "exec_program";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This is part of the customizable file search criteria. 
If the user-defined  program returns exit status 0, the file is considered matched.

     <br><dt>&lsquo;<samp><code>file_types</code></samp>&rsquo;<dd><b>Type</b>: (option list)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>plain</code>
                    <code>reg</code>
                    <code>symlink</code>
                    <code>dir</code>
                    <code>socket</code>
                    <code>fifo</code>
                    <code>door</code>
                    <code>char</code>
                    <code>block</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: List of acceptable file types from menu choices

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body file_select filter
     {
     file_types => { "plain","symlink" };
     
     file_result => "file_types";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>File types vary in details between operating systems. The main POSIX
types are provided here as menu options.

     <br><dt>&lsquo;<samp><code>issymlinkto</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: List of regular expressions to match file objects

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body file_select example
     {
     issymlinkto => { "/etc/[^/]*", "/etc/init.d/[a-z0-9]*" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>A list of regular expressions. If the file is a symbolic link which
points to files matched by one of these expressions, the file will be selected.

     <br><dt>&lsquo;<samp><code>file_result</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[(leaf_name|path_name|file_types|mode|size|owner|group|atime|ctime|mtime|issymlinkto|exec_regex|exec_program|bsdflags)[|&amp;!.]*]*</code>

     <p class="noindent"><b>Synopsis</b>: Logical expression combining classes defined by file search criteria

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body file_select any_age
     
     {
     mtime       => irange(ago(1,0,0,0,0,0),now);  
     file_result => "mtime"; 
     }
     
     body file_select pdf_files_1dayold
     
     {
     mtime       => irange(ago(0,0,1,0,0,0),now);  
     leaf_name   => { ".*.pdf" , ".*.fdf" };
     
     file_result => "leaf_name&amp;mtime";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Sets the criteria for file selection outcome during file searches. The
syntax is the same as for a class expression since the file selection
is a classification of the file-search in the same way that system
classes are a classification of the abstact host-search.

     <p>Items should be from the following list:

          <ul>
<li>leaf_name
<li>path_name
<li>file_types
<li>mode
<li>size
<li>owner
<li>group
<li>atime
<li>ctime
<li>mtime
<li>issymlinkto
<li>exec_regex
<li>exec_program
</ul>

   </dl>

<div class="node">
<p><hr>
<a name="link_from-in-files"></a>
<a name="link_005ffrom-in-files"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#move_005fobstructions-in-files">move_obstructions in files</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#file_005fselect-in-files">file_select in files</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#files-in-agent-promises">files in agent promises</a>

</div>

<h4 class="subsection">7.3.11 <code>link_from</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>copy_patterns</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: A set of patterns that should be copied ansd synchronized instead of linked

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body link_from example
     {
     copy_patterns =>  { "special_node1", "/path/special_node2" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>During the linking of files, it is sometimes useful to buffer changes
with an actual copy, especially if the link is to an emphemeral file
system. This list of patterns matches files that arise during a
linking policy. A positive match means that the file should be copied
and updated by modification time.

     <br><dt>&lsquo;<samp><code>link_children</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false whether to link all directory's children to source originals

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body link_from example
     {
     link_children => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>If the promiser is a directory, instead of copying the children, link them to the
source.

     <br><dt>&lsquo;<samp><code>link_type</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>symlink</code>
                    <code>hardlink</code>
                    <code>relative</code>
                    <code>absolute</code>
                    <code>none</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: The type of link used to alias the file

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body link_from example
     {
     link_type => "hard";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>What kind of link should be used to link files. Users are advised to
be wary of `hard links' (see Unix manual pages for the &lsquo;<samp><span class="samp">ln</span></samp>&rsquo;
command). The behaviour of non-symbolic links is often precarious and
unpredictable.

     <br><dt>&lsquo;<samp><code>source</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: The source file to which the link should point

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body copy_from example
     {
     source => "/path/to/source";
     }
     
     # or
     
     body link_from example
     {
     source => "/path/to/source";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>For remote copies this refers to the file name on the remote server.

     <br><dt>&lsquo;<samp><code>when_linking_children</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>override_file</code>
                    <code>if_no_such_file</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Policy for overriding existing files when linking directories of children

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body link_from example
     {
     when_linking_children => "if_no_such_file";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The options refer to what happens if the directory exists already and
is already partially populated with files. If the directory being
copied from contains a file with the same name as that of a link
to be created, we must decide whether to override the existing
destination object with a link or simply omit the automatic
linkage for files that already exist. The latter case can
be used to make a copy of one directory with certain fields
overridden.

     <br><dt>&lsquo;<samp><code>when_no_source</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>force</code>
                    <code>delete</code>
                    <code>nop</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Behaviour when the source file to link to does not exist

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body link_from example
     {
     when_no_file => "force";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>If we try to create a link to a file that does not exist a link, how
should cfengine respond? The options are to force the creation to
a file that does not (yet) exist, delete any existing link, or do nothing.

   </dl>

<div class="node">
<p><hr>
<a name="move_obstructions-in-files"></a>
<a name="move_005fobstructions-in-files"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#pathtype-in-files">pathtype in files</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#link_005ffrom-in-files">link_from in files</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#files-in-agent-promises">files in agent promises</a>

</div>

<h4 class="subsection">7.3.12 <code>move_obstructions</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false whether to move obstructions to file-object creation

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
files:

  "/tmp/testcopy" 

    copy_from    => mycopy("/tmp/source"),
    move_obstructions => "true",
    depth_search => recurse("inf");

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If we have promised to make file <samp><span class="file">X</span></samp> a link, but it already
exists as a file, or vice-versa, or if a file is blocking the creation
of a directory etc, then normally cfengine will report an error. If
this is set, existing objects will be moved aside to allow the system
to heal without intervention. Files and directories are saved/renamed, but
symbolic links are deleted.

<div class="node">
<p><hr>
<a name="pathtype-in-files"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#perms-in-files">perms in files</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#move_005fobstructions-in-files">move_obstructions in files</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#files-in-agent-promises">files in agent promises</a>

</div>

<h4 class="subsection">7.3.13 <code>pathtype</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>literal</code>
               <code>regex</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: Menu option for interpreting promiser file object

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
files:

   "/var/.*/lib"

      pathtype => "regex", #default
         perms => system;

   "/var/.*/lib"

      pathtype => "literal", 
         perms => system;

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If the keyword <code>literal</code> is invoked, a path looking like
a regular expression will be treated as a literal string. Thus in
the example, one case implies an iteration over all files/directories
matching the regular expression, while the other means a single
literal object with a name composed of dots and stars.

<div class="node">
<p><hr>
<a name="perms-in-files"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#rename-in-files">rename in files</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#pathtype-in-files">pathtype in files</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#files-in-agent-promises">files in agent promises</a>

</div>

<h4 class="subsection">7.3.14 <code>perms</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>bsdflags</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>[+-]*[(arch|archived|nodump|opaque|sappnd|sappend|schg|schange|simmutable|sunlnk|sunlink|uappnd|uappend|uchg|uchange|uimmutable|uunlnk|uunlink)]+</code>

     <p class="noindent"><b>Synopsis</b>: List of menu options for bsd file system flags to set

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body perms example
     
     {
     #..
     bsdflags => { "uappnd","uchg","uunlnk","nodump",
                   "opaque","sappnd","schg","sunlnk" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The free BSD Unices and MacOSX have additional filesystem flags which
can be set. Refer to the BSD <code>chflags</code> documentation for
this.

     <br><dt>&lsquo;<samp><code>groups</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>[a-zA-Z0-9_$.-]+</code>

     <p class="noindent"><b>Synopsis</b>: List of acceptable groups of group ids, first is change target

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     body perms example
     {
     groups => { "users", "administrators" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The first named group is the list is the defaul that will be configured if
the file does not match an element of the list.

     <br><dt>&lsquo;<samp><code>mode</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[0-7augorwxst,+-]+</code>

     <p class="noindent"><b>Synopsis</b>: File permissions (like posix chmod)

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body perms example
     {
     mode => "a+rx,o+w";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The mode string may be symbolic or numerical, like <code>chmod</code>.

     <br><dt>&lsquo;<samp><code>owners</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>[a-zA-Z0-9_$.-]+</code>

     <p class="noindent"><b>Synopsis</b>: List of acceptable owners or user ids, first is change target

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body perms example
     {
     owners => { "mark", "wwwrun", "jeang" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The first user is the reference value that cfengine will set the file to if
none of the list items matches the true state of the file.

     <br><dt>&lsquo;<samp><code>rxdirs</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false add execute flag for directories if read flag is set

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body perms rxdirs
     {
     rxdirs => "false";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Default behaviour is to set the &lsquo;<samp><span class="samp">x</span></samp>&rsquo; flag on directories
automatically if the &lsquo;<samp><span class="samp">r</span></samp>&rsquo; flag is specified when specifying
multiple files in a single promise.

   </dl>

<div class="node">
<p><hr>
<a name="rename-in-files"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#repository-in-files">repository in files</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#perms-in-files">perms in files</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#files-in-agent-promises">files in agent promises</a>

</div>

<h4 class="subsection">7.3.15 <code>rename</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>disable</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false automatically rename and remove permissions

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body rename example
     {
     disable => "true"; 
     disable_suffix => ".nuked";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Disabling a file means making is impotent in the context in which it
has an effect. For executables this means preventing execution, for an
information file it means making the file unreadable.

     <br><dt>&lsquo;<samp><code>disable_mode</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[0-7augorwxst,+-]+</code>

     <p class="noindent"><b>Synopsis</b>: The permissions to set when a file is disabled

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body rename example
     {
     disable_mode => "0600"; 
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>To disable an executable it is not enough to rename it, you should also remove the
executable flag.

     <br><dt>&lsquo;<samp><code>disable_suffix</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: The suffix to add to files when disabling (.cfdisabled)

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body rename example
     {
     disable => "true"; 
     disable_suffix => ".nuked";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>To make disabled files in a particular manner, use this string suffix. 
The default value is <samp><span class="file">.cf-disabled</span></samp>.

     <br><dt>&lsquo;<samp><code>newname</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: The desired name for the current file

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body rename example(s)
     {
     newname => "$(s)";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <br><dt>&lsquo;<samp><code>rotate</code></samp>&rsquo;<dd><b>Type</b>: int

     <p class="noindent"><b>Allowed input range</b>: <code>0,99</code>

     <p class="noindent"><b>Synopsis</b>: Maximum number of file rotations to keep

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body rename example
     {
     rotate => "4";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Used for log rotation.

   </dl>

<div class="node">
<p><hr>
<a name="repository-in-files"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#touch-in-files">touch in files</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#rename-in-files">rename in files</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#files-in-agent-promises">files in agent promises</a>

</div>

<h4 class="subsection">7.3.16 <code>repository</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

<p class="noindent"><b>Synopsis</b>: Name of a repository for versioning

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
files:

 "/path/file"

   copy_from => source,
   repository => "/var/cfengine/repository";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>A local repository for this object, overrides the default.

<div class="node">
<p><hr>
<a name="touch-in-files"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#transformer-in-files">transformer in files</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#repository-in-files">repository in files</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#files-in-agent-promises">files in agent promises</a>

</div>

<h4 class="subsection">7.3.17 <code>touch</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false whether to touch time stamps on file

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
files:

 "/path/file"

   touch => "true";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="transformer-in-files"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#touch-in-files">touch in files</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#files-in-agent-promises">files in agent promises</a>

</div>

<h4 class="subsection">7.3.18 <code>transformer</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

<p class="noindent"><b>Synopsis</b>: Command (with full path) used to transform current file (no shell wrapper used)

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
 "/home/mark/tmp/testcopy"

    file_select => pdf_files,
    transformer => "/usr/bin/gzip $(this.promiser)",
    depth_search => recurse("inf");

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>A command to execute on finding a file.

<div class="node">
<p><hr>
<a name="delete_lines-in-edit_line-promises"></a>
<a name="delete_005flines-in-edit_005fline-promises"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#insert_005flines-in-edit_005fline-promises">insert_lines in edit_line promises</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#files-in-agent-promises">files in agent promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-agent">Bundles for agent</a>

</div>

<h3 class="section">7.4 <code>delete_lines</code> promises in &lsquo;<samp><span class="samp">edit_line</span></samp>&rsquo;</h3>

<p><br>

   <p>This promise assures that certain lines matching regular expression
patterns exactly will not be present in a text file. If the lines are
found, the default promise is to remove them.

   <p><br>

<pre class="verbatim">
bundle edit_line example
  {
  delete_lines:

    "olduser.*";

  }

</pre>

   <p><br>

<ul class="menu">
<li><a accesskey="1" href="#delete_005fselect-in-delete_005flines">delete_select in delete_lines</a>
<li><a accesskey="2" href="#not_005fmatching-in-delete_005flines">not_matching in delete_lines</a>
</ul>

<div class="node">
<p><hr>
<a name="delete_select-in-delete_lines"></a>
<a name="delete_005fselect-in-delete_005flines"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#not_005fmatching-in-delete_005flines">not_matching in delete_lines</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#delete_005flines-in-edit_005fline-promises">delete_lines in edit_line promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#delete_005flines-in-edit_005fline-promises">delete_lines in edit_line promises</a>

</div>

<h4 class="subsection">7.4.1 <code>delete_select</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>delete_if_startwith_from_list</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: Delete line if it starts with a string in the list

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body delete_select example(s)
     {
     delete_if_startwith_from_list => { @(s) };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Delete lines from a file if they begin with the sub-strings listed.

     <br><dt>&lsquo;<samp><code>delete_if_not_startwith_from_list</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: Delete line if it DOES NOT start with a string in the list

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body delete_select example(s)
     {
     delete_if_not_startwith_from_list => { @(s) };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Delete lines from a file unless they start with the sub-strings in the list given.

     <br><dt>&lsquo;<samp><code>delete_if_match_from_list</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: Delete line if it fully matches a regex in the list

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body delete_select example(s)
     {
     delete_if_match_from_list => { @(s) };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Delete lines from a file if they completely match the regular expressions listed.

     <br><dt>&lsquo;<samp><code>delete_if_not_match_from_list</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: Delete line if it DOES NOT fully match a regex in the list

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body delete_select example(s)
     {
     delete_if_not_match_from_list => { @(s) };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Delete lines from a file unless they fully match regular expressions
in the list.

     <br><dt>&lsquo;<samp><code>delete_if_contains_from_list</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: Delete line if a regex in the list match a line fragment

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body delete_select example(s)
     {
     delete_if_contains_from_list => { @(s) };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Delete lines from a file if they contain the sub-strings listed.

     <br><dt>&lsquo;<samp><code>delete_if_not_contains_from_list</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: Delete line if a regex in the list DOES NOT match a line fragment

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body delete_select discard(s)
     {
     delete_if_not_contains_from_list => { "substring1", "substring2" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Delete lines from the file which do not contain the sub-strings listed.

   </dl>

<div class="node">
<p><hr>
<a name="not_matching-in-delete_lines"></a>
<a name="not_005fmatching-in-delete_005flines"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#delete_005fselect-in-delete_005flines">delete_select in delete_lines</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#delete_005flines-in-edit_005fline-promises">delete_lines in edit_line promises</a>

</div>

<h4 class="subsection">7.4.2 <code>not_matching</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false negate match criterion

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">delete_lines:

  # edit /etc/passwd

  "mark.*|root.*" not_matching => "true";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The negation of an expression (for convenience).

<div class="node">
<p><hr>
<a name="insert_lines-in-edit_line-promises"></a>
<a name="insert_005flines-in-edit_005fline-promises"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#field_005fedits-in-edit_005fline-promises">field_edits in edit_line promises</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#delete_005flines-in-edit_005fline-promises">delete_lines in edit_line promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-agent">Bundles for agent</a>

</div>

<h3 class="section">7.5 <code>insert_lines</code> promises in &lsquo;<samp><span class="samp">edit_line</span></samp>&rsquo;</h3>

<p><br>

   <p>This promise is part of the line-editing model. It inserts lines into
the file at a specified location. The location is determined by
body-attributes.  The promise object referred to can be a literal line
of a file-reference from which to read lines.

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
      insert_lines:
     
        "<var>literal line or file reference</var>"
     
           location =&gt; <var>location_body</var>,
           ...;
     
</pre>
   </td></tr></table>

   <p><br>

<pre class="verbatim">
body common control

{
any::

  bundlesequence  => {
                     example
                     };   
}

#######################################################

bundle agent example

{
files:

  "/var/spool/cron/crontabs/root"

     edit_line => addline;
}

#######################################################
# For the library
#######################################################

bundle edit_line addline

{
insert_lines:

 "0,5,10,15,20,25,30,35,40,45,50,55 * * * * /var/cfengine/bin/cf-execd -F";

}

</pre>

   <p><br>

   <p>By parameterizing the editing bundle, one can make generic and reusable editing bundles.

   <p>Note, when inserting multiple lines anchored to a particular place in
a file, be careful with your intuition.  If your intention is to
insert a set of lines in a given order after a marker, then the
following is incorrect:

<pre class="verbatim">
bundle edit_lines x
{
insert_lines:

  "line one" location => myloc;
  "line two" location => myloc;
}

body location myloc

{
select_line_matching => "^# Right here.*";
before_after => "after";
}

</pre>
This will reverse the order of the lines and will not converge, since
the anchoring after the marker applies independently for each new
line. This is not a bug, but an error of logic.

   <p>What was probably intended was to add multiple ordered lines after the marker,
which should be a single correlated promise.

<pre class="verbatim">
bundle edit_lines x
{
insert_lines:
 
 "line one$(const.n)line two" location => myloc;

}

</pre>
Or:
<pre class="verbatim">
bundle edit_lines x
{
insert_lines:
 
  "line one
line two" location => myloc;

}

</pre>

<ul class="menu">
<li><a accesskey="1" href="#expand_005fscalars-in-insert_005flines">expand_scalars in insert_lines</a>
<li><a accesskey="2" href="#insert_005ftype-in-insert_005flines">insert_type in insert_lines</a>
<li><a accesskey="3" href="#insert_005fselect-in-insert_005flines">insert_select in insert_lines</a>
<li><a accesskey="4" href="#location-in-insert_005flines">location in insert_lines</a>
</ul>

<div class="node">
<p><hr>
<a name="expand_scalars-in-insert_lines"></a>
<a name="expand_005fscalars-in-insert_005flines"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#insert_005ftype-in-insert_005flines">insert_type in insert_lines</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#insert_005flines-in-edit_005fline-promises">insert_lines in edit_line promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#insert_005flines-in-edit_005fline-promises">insert_lines in edit_line promises</a>

</div>

<h4 class="subsection">7.5.1 <code>expand_scalars</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: Expand any unexpanded variables

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "testbundle"  };
}

########################################################

bundle agent testbundle

{
files:

  "/home/mark/tmp/file_based_on_template"

       create    => "true",
       edit_line => ExpandMeFrom("/tmp/source_template");


}

########################################################

bundle edit_line ExpandMeFrom(template)
{
insert_lines:

   "$(template)"

          insert_type => "file",
       expand_scalars => "true";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>A way of incorporating templates with variable expansion into file
operations. Variables should be named and scoped appropriately for the
bundle in which this promise is made.

   <p>In cfengine 2 <code>editfiles</code> this was called &lsquo;<samp><span class="samp">ExpandVariables</span></samp>&rsquo;.

<div class="node">
<p><hr>
<a name="insert_type-in-insert_lines"></a>
<a name="insert_005ftype-in-insert_005flines"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#insert_005fselect-in-insert_005flines">insert_select in insert_lines</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#expand_005fscalars-in-insert_005flines">expand_scalars in insert_lines</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#insert_005flines-in-edit_005fline-promises">insert_lines in edit_line promises</a>

</div>

<h4 class="subsection">7.5.2 <code>insert_type</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>literal</code>
               <code>string</code>
               <code>file</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: Type of object the promiser string refers to (default literal)

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim"> insert_lines:

     "test lines"

       insert_type => "file";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The default is to treat the promiser as a literal string. This is used
to tell cfengine that the string is non-literal and should be
interpreted as a filename from which to import lines.

<div class="node">
<p><hr>
<a name="insert_select-in-insert_lines"></a>
<a name="insert_005fselect-in-insert_005flines"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#location-in-insert_005flines">location in insert_lines</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#insert_005ftype-in-insert_005flines">insert_type in insert_lines</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#insert_005flines-in-edit_005fline-promises">insert_lines in edit_line promises</a>

</div>

<h4 class="subsection">7.5.3 <code>insert_select</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>insert_if_startwith_from_list</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: Insert line if it starts with a string in the list

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body insert_select example
     {
     insert_if_startwith_from_list => { "find_me_1", "find_me_2" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The list contains literal strings to search for in an secondary file
(not the main file being edited). If the string is found as the first
characters (at the start) of a line in the file, that line from the
secondary file will be inserted at the present location in the primary
file.

     <br><dt>&lsquo;<samp><code>insert_if_not_startwith_from_list</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: Insert line if it DOES NOT start with a string in the list

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body insert_select example
     {
     insert_if_not_startwith_from_list => { "find_me_1", "find_me_2" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The complement of <code>insert_if_startwith_from_list</code>.

     <br><dt>&lsquo;<samp><code>insert_if_match_from_list</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: Insert line if it fully matches a regex in the list

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body insert_select example
     {
     insert_if_match_from_list => { ".*find_.*_1.*", ".*find_.*_2.*" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The list contains regular expressions to search for in an secondary file (not the
main file being edited). If the regex matches a complete line of the file,
that line from the secondary file will be inserted at the present location
in the primary file.

     <br><dt>&lsquo;<samp><code>insert_if_not_match_from_list</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: Insert line if it DOES NOT fully match a regex in the list

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body insert_select example
     {
     insert_if_not_match_from_list => { ".*find_.*_1.*", ".*find_.*_2.*" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The complement of <code>insert_if_match_from_list</code>.

     <br><dt>&lsquo;<samp><code>insert_if_contains_from_list</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: Insert line if a regex in the list match a line fragment

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body insert_select example
     {
     insert_if_contains_from_list => { "find_me_1", "find_me_2" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The list contains literal strings to search for in an secondary file (not the
main file being edited). If the string is found in a line of the file,
that line from the secondary file will be inserted at the present location
in the primary file.

     <br><dt>&lsquo;<samp><code>insert_if_not_contains_from_list</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: Insert line if a regex in the list DOES NOT match a line fragment

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body insert_select example
     {
     insert_if_not_contains_from_list => { "find_me_1", "find_me_2" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The complement of <code>insert_if_contains_from_list</code>.

   </dl>

<div class="node">
<p><hr>
<a name="location-in-insert_lines"></a>
<a name="location-in-insert_005flines"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#insert_005fselect-in-insert_005flines">insert_select in insert_lines</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#insert_005flines-in-edit_005fline-promises">insert_lines in edit_line promises</a>

</div>

<h4 class="subsection">7.5.4 <code>location</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>before_after</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>before</code>
                    <code>after</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Menu option, point cursor before of after matched line

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body location append
     
     {
     #...
     before_after => "before";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Determines whether an edit will occur before or after the currently
matched line.

     <br><dt>&lsquo;<samp><code>first_last</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>first</code>
                    <code>last</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Menu option, choose first or last occurrence of match in file

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body location example
     {
     first_last => "last";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>In multiple matches, decide whether the first or last occurrence of
the matching pattern in the case affected by the change. In principle
this could be generalized to more cases but this seems like a fragile
quality to evaluate, and only these two cases are deemed of
reproducible significance.

     <br><dt>&lsquo;<samp><code>select_line_matching</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: Regular expression for matching file line location

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body match_value example
     {
     select_line_matching => "^Expression match.* whole line$";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The &lsquo;<samp><span class="samp">^$</span></samp>&rsquo; are not necessary, just remember that the expression must match
a whole line, not a fragment within a line.

   </dl>

<div class="node">
<p><hr>
<a name="field_edits-in-edit_line-promises"></a>
<a name="field_005fedits-in-edit_005fline-promises"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#replace_005fpatterns-in-edit_005fline-promises">replace_patterns in edit_line promises</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#insert_005flines-in-edit_005fline-promises">insert_lines in edit_line promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-agent">Bundles for agent</a>

</div>

<h3 class="section">7.6 <code>field_edits</code> promises in &lsquo;<samp><span class="samp">edit_line</span></samp>&rsquo;</h3>

<p><br>

   <p>Certain types of text file (e.g. the <samp><span class="file">passwd</span></samp> and <samp><span class="file">group</span></samp>
files in Unix) are tabular in nature, with field separators
(e.g. &lsquo;<samp><span class="samp">:</span></samp>&rsquo; or &lsquo;<samp><span class="samp">,</span></samp>&rsquo;). This promise assumes a parameterizable model
for editing the fields of such files, using a regular expression to
separate major fields and a character to separate sub-fields. First
you match the line with a regular expression, then a
<code>field_edits</code> body describes the separators for fields and one
level of sub-fields, along with policies for editing these fields, ordering
the items within them etc.

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
     field_edits:
     
         "<var>regex matching line</var>"
     
                   edit_field =&gt; <var>body</var>;
     
</pre>
   </td></tr></table>

   <p><br>

<pre class="verbatim">
bundle agent example

{
vars:

 "userset" slist => { "one-x", "two-x", "three-x" };

files:

  "/tmp/passwd"

       create    => "true",
       edit_line => SetUserParam("mark","6","/set/this/shell");

  "/tmp/group"

       create    => "true",
       edit_line => AppendUserParam("root","4","@(userset)");
}

########################################################

bundle edit_line SetUserParam(user,field,val)
  {
  field_edits:

   "$(user).*"

      # Set field of the file to parameter

      edit_field => col(":","$(field)","$(val)","set");
  }

########################################################

bundle edit_line AppendUserParam(user,field,allusers)
  {
  vars:

    "val" slist => { @(allusers) };

  field_edits:

   "$(user).*"

      # Set field of the file to parameter

      edit_field => col(":","$(field)","$(val)","alphanum");

  }

########################################
# Bodies
########################################

body edit_field col(split,col,newval,method)

{
field_separator => "$(split)";
select_field    => "$(col)";
value_separator  => ",";
field_value     => "$(newval)";
field_operation => "$(method)";
extend_fields => "true";
}

</pre>

   <p><br>

   <p>Field editing allows us to edit tabular files in a unique way, adding
and removing data from addressable fields. The <samp><span class="file">passwd</span></samp> and
<samp><span class="file">group</span></samp> files are classic examples of tabular files, but there
are many ways to use this feature, e.g. edit a string

<pre class="verbatim">
VARIABLE="one two three"

</pre>

<p class="noindent">View this line as a tabular line separated by &lsquo;<samp><span class="samp">"</span></samp>&rsquo; and
with sub-separator given by the space.

<ul class="menu">
<li><a accesskey="1" href="#edit_005ffield-in-field_005fedits">edit_field in field_edits</a>
</ul>

<div class="node">
<p><hr>
<a name="edit_field-in-field_edits"></a>
<a name="edit_005ffield-in-field_005fedits"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#field_005fedits-in-edit_005fline-promises">field_edits in edit_line promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#field_005fedits-in-edit_005fline-promises">field_edits in edit_line promises</a>

</div>

<h4 class="subsection">7.6.1 <code>edit_field</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>allow_blank_fields</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false allow blank fields in a line (do not purge)

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body edit_field example
     {
     # ...
     allow_blank_fields => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>When editing a file using the field or column model, blank fields, especially
at the start and end are generally discarded. If this is set to true, cfengine
will retain the blank fields and print the appropriate number of field separators.

     <br><dt>&lsquo;<samp><code>extend_fields</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false add new fields at end of line if necessary to complete edit

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body edit_field example
     {
     extend_fields => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>If a user specifies a field that does not exist, because there are not
so many fields, this allows the number of fields to be extended. 
Without this setting, cfengine will issue an error if a non-existent field
is referenced. 
Blank fields in a tabular file can be eliminated or kept depending
in this setting. If in doubt, set this to true.

     <br><dt>&lsquo;<samp><code>field_operation</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>prepend</code>
                    <code>append</code>
                    <code>alphanum</code>
                    <code>delete</code>
                    <code>set</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Menu option policy for editing subfields

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body edit_field example
     {
     field_operation => "append";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The method by which to edit a field in multi-field/column editing
of tabular files.

     <br><dt>&lsquo;<samp><code>field_separator</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: The regular expression used to separate fields in a line

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body edit_field example
     {
     field_separator => ":";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Most tabular files are separated by simple characters, but by allowing
a general regular expression one can make creative use of this model to
edit all kinds of line-based text files.

     <br><dt>&lsquo;<samp><code>field_value</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: Set field value to a fixed value

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body edit_field example(s)
     {
     field_value => "$(s)";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Set a field to a constant value, e.g. reset the value to a constant
default, empty the field, or set it fixed list.

     <br><dt>&lsquo;<samp><code>select_field</code></samp>&rsquo;<dd><b>Type</b>: int

     <p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

     <p class="noindent"><b>Synopsis</b>: Integer index of the field required 1..n

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body field_edits example
     {
     select_field => "5";
     }
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Numering starts from 1 not from 0.

     <br><dt>&lsquo;<samp><code>value_separator</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>^.$</code>

     <p class="noindent"><b>Synopsis</b>: Character separator for subfields inside the selected field

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body field_edit example
     {
     value_separator => ",";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>For example, elements in the group file are separated by &lsquo;<samp><span class="samp">:</span></samp>&rsquo;,
but the lists of users in these fields are separated by &lsquo;<samp><span class="samp">,</span></samp>&rsquo;.

   </dl>

<div class="node">
<p><hr>
<a name="replace_patterns-in-edit_line-promises"></a>
<a name="replace_005fpatterns-in-edit_005fline-promises"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#interfaces-in-agent-promises">interfaces in agent promises</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#field_005fedits-in-edit_005fline-promises">field_edits in edit_line promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-agent">Bundles for agent</a>

</div>

<h3 class="section">7.7 <code>replace_patterns</code> promises in &lsquo;<samp><span class="samp">edit_line</span></samp>&rsquo;</h3>

<p><br>

   <p>This promise refers to arbitrary text patterns in a file. 
The pattern is expressed as a regular expression and must be
compatible with the default model for regular expressions on
your system. The default model is PCRE (Perl Compatible Regular
Expressions) if available.

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
       replace_patterns:
     
        "<var>search pattern</var>"
     
           replace_with =&gt; <var>replace_body</var>,
           ...;
     
</pre>
   </td></tr></table>

   <p><br>

<pre class="verbatim">
bundle edit_line upgrade_cfexecd
  {
  replace_patterns:

    "cfexecd" replace_with => With("cf-execd");
  }

########################################

body replace_with With(x)

{
replace_value => "$(x)";
occurrences => "all";
}

</pre>

   <p><br>

   <p>This is a straightforward search and replace function. In this case
only for line editing the regular expression may match a line fragment
&ndash; it need not match the entire line.

<ul class="menu">
<li><a accesskey="1" href="#replace_005fwith-in-replace_005fpatterns">replace_with in replace_patterns</a>
</ul>

<div class="node">
<p><hr>
<a name="replace_with-in-replace_patterns"></a>
<a name="replace_005fwith-in-replace_005fpatterns"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#replace_005fpatterns-in-edit_005fline-promises">replace_patterns in edit_line promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#replace_005fpatterns-in-edit_005fline-promises">replace_patterns in edit_line promises</a>

</div>

<h4 class="subsection">7.7.1 <code>replace_with</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>occurrences</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>all</code>
                    <code>first</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Menu option to replace all occurrences or just first (NB the latter is non-convergent)

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body replace_with example
     {
     occurrences => "first";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>A policy for string replacement.

     <br><dt>&lsquo;<samp><code>replace_value</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: Value used to replace regular expression matches in search

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body replace_with example(s)
     {
     replace_value => "$(s)";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

   </dl>

<div class="node">
<p><hr>
<a name="interfaces-in-agent-promises"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#methods-in-agent-promises">methods in agent promises</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#replace_005fpatterns-in-edit_005fline-promises">replace_patterns in edit_line promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-agent">Bundles for agent</a>

</div>

<h3 class="section">7.8 <code>interfaces</code> promises in &lsquo;<samp><span class="samp">agent</span></samp>&rsquo;</h3>

<p><br>

   <p>Interfaces promises describe the configurable aspects relating to
network interfaces. Most workstations and servers have only a single
network interface, but routers and multi-homed hosts often have
multiple interfaces. Interface promises include attributes such as the
IP address identity, assumed netmask and routing policy in the case of
multi-homed hosts. For virtual machines and hosts, the list of
interfaces can be quite large.

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
      interfaces:
     
        "<var>interface name</var>"
     
          tcp_ip =&gt; <var>tcp_ip_body</var>,
          ...;
     
</pre>
   </td></tr></table>

   <p><br>

<pre class="verbatim">
Fill me in (/home/mark/LapTop/CfengineProjects/CompanyDocuments/trunk/Cfengine3Reference/promise_interfaces_example.texinfo)
""
</pre>

   <p><br>

<pre class="verbatim">
Fill me in (/home/mark/LapTop/CfengineProjects/CompanyDocuments/trunk/Cfengine3Reference/promise_interfaces_notes.texinfo)
""
</pre>

<ul class="menu">
<li><a accesskey="1" href="#tcp_005fip-in-interfaces">tcp_ip in interfaces</a>
</ul>

<div class="node">
<p><hr>
<a name="tcp_ip-in-interfaces"></a>
<a name="tcp_005fip-in-interfaces"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#interfaces-in-agent-promises">interfaces in agent promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#interfaces-in-agent-promises">interfaces in agent promises</a>

</div>

<h4 class="subsection">7.8.1 <code>tcp_ip</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>ipv4_address</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[0-9.]+/[0-4]+</code>

     <p class="noindent"><b>Synopsis</b>: IPv4 address for the interface

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body tcp_ip example
     {
     ipv4_address => "123.456.789.001";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The address will be checked and if necessary set. Today few hosts will
be managed in this way: address management will be handled by other services
like DHCP.

     <br><dt>&lsquo;<samp><code>ipv4_netmask</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[0-9.]+/[0-4]+</code>

     <p class="noindent"><b>Synopsis</b>: Netmask for the interface

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body tcp_ip example
     {
     ipv4_netmask => "255.255.254.0";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>In many cases the CIDR form of address will show the netmask as &lsquo;<samp><span class="samp">/23</span></samp>&rsquo;, but
this offers and `old style' alternative.

     <br><dt>&lsquo;<samp><code>ipv6_address</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[0-9a-fA-F:]+/[0-9]+</code>

     <p class="noindent"><b>Synopsis</b>: IPv6 address for the interface

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body tcp_ip example
     {
     ipv6_address => "2001:700:700:3:20f:1fff:fe92:2cd3/64";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

   </dl>

<div class="node">
<p><hr>
<a name="methods-in-agent-promises"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#packages-in-agent-promises">packages in agent promises</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#interfaces-in-agent-promises">interfaces in agent promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-agent">Bundles for agent</a>

</div>

<h3 class="section">7.9 <code>methods</code> promises in &lsquo;<samp><span class="samp">agent</span></samp>&rsquo;</h3>

<p><br>

   <p>Methods are compound promises that refer to whole bundles of promises. 
Methods may be parameterized. Methods promises are written in a form
that is ready for future development. The promiser object is an
abstract identifier that refers to a collection (or pattern) of lower
level objects that are affected by the promise-bundle. Since the use
of these identifiers is for the future, you can simply use any string
here for the time being.

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
      methods:
     
        "any"
     
           usebundle =&gt; <var>method_id</var>("parameter",...);
     
</pre>
   </td></tr></table>

   <p>Methods are useful for encapsulating repeatedly used configuration
issues and iterating over parameters.

   <p>In cfengine 2 methods referred to separate sub-programs executed
as separate processes. Methods are now implemented as bundles
that are run inline.

   <p><br>

<pre class="verbatim">

bundle agent example
{
vars:

 "userlist" slist => { "mark", "jeang", "jonhenrik", "thomas", "eben" };

methods:

 "any" usebundle => subtest("$(userlist)");

}

###########################################

bundle agent subtest(user)

{
commands:

 "/bin/echo Fix $(user)";

reports:

 linux::

  "Finished doing stuff for $(user)";
}


</pre>

   <p><br>

   <p>Methods offer powerful ways to encapsulate multiple issues pertaining
to a set of parameters.

<ul class="menu">
<li><a accesskey="1" href="#usebundle-in-methods">usebundle in methods</a>
</ul>

<div class="node">
<p><hr>
<a name="usebundle-in-methods"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#methods-in-agent-promises">methods in agent promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#methods-in-agent-promises">methods in agent promises</a>

</div>

<h4 class="subsection">7.9.1 <code>usebundle</code></h4>

<p><b>Type</b>: (ext bundle) (Separate Bundle)

<div class="node">
<p><hr>
<a name="packages-in-agent-promises"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#processes-in-agent-promises">processes in agent promises</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#methods-in-agent-promises">methods in agent promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-agent">Bundles for agent</a>

</div>

<h3 class="section">7.10 <code>packages</code> promises in &lsquo;<samp><span class="samp">agent</span></samp>&rsquo;</h3>

<p><br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="verbatim">
 vars:

  "match_package" slist => { 
                           "apache2", 
                           "apache2-mod_php5",
                           "apache2-prefork",
                           "php5" 
                           };
 packages:

    "$(match_package)"

         package_policy => "add",
         package_method => yum;

</pre>
</td></tr></table>

   <p>Software packaging is a core paradigm in operating system release
management today, and cfengine supports a generic approach to
integration with native operating support for packaging.  Package
promises allow cfengine to make promises the state of software
packages <i>conditionally</i>, given the assumption that a native package
manager will perform the actual manipulations. Since no agent can make
unconditional promises about another, this is the best that can be
achieved.

   <p>Packages are treated as black-boxes with three labels:

     <ul>
<li>A package name. 
<li>A version string. 
<li>An architecture name. 
</ul>

   <p>Package managers are treated as black boxes that may support some or all of the
following promise types:

     <ul>
<li>List installed packages
<li>Add packages
<li>Delete packages
<li>Reinstall (repair) packages
<li>Upgrade packages
<li>Patch packages
<li>Verify packages
</ul>

   <p>If these services are promised by a package manager, <code>cf-agent</code>
promises to use the service and encapsulate it within the overall
cfengine framework.

   <p><b>Domain knowledge</b>

   <p>Cfengine does not maintain operating system specific expert knowledge
internally, rather it uses a generic model for dealing with promises about
packages (which depend on the behaviour of an external package manager). 
The approach is to define package system details in body-constraints that
can be written once and for all, for each package system.

   <p>Package promises are like <code>commands</code> promises in the sense that
cfengine promises nothing about the outcome of executing a
command. All it can promise is to interface with it, starting it and
using the results in good faith. Packages are basically `outsourced',
to invoke IT parlance.

   <p>The possibility of a cfengine package format that enables more guaranteeable
behaviour for special purposes has not been excluded for the future,
but in any case <code>cf-agent</code> must support native package formats
used by operating system maintainers as these are a core part of modern
operating systems.

   <p><b>Behaviour</b>

   <p>A package promise consists of a name, a version and an architecture, <i>(n,v,a)</i>,
and behaviour to be promised about packages that match criteria based on these. 
The components <i>(n,v,a)</i> can be determined in one of two different ways:

     <ul>
<li>They may be specified independently, e.g.

     <pre class="verbatim">     packages:
     
       "mypackage"
     
          package_policy => "add",
          package_method => rpm,
          package_select => ">=",
          package_architectures => { "x86_64", "i586" },
          package_version => "1.2.3";
     
</pre>

     <li>They may be extracted from a package identifier or filename, using pattern matching, e.g.:

     <pre class="verbatim">      package_list_name_regex    => "[^|]+\|[^|]+\|\s+([^\s|]+).*";
      package_list_version_regex => "[^|]+\|[^|]+\|[^|]+\|\s+([^\s|]+).*";
      package_list_arch_regex    => "[^|]+\|[^|]+\|[^|]+\|[^|]+\|\s+([^\s]+).*";
</pre>

   </ul>

   <p>When scanning a list of installed packages different managers present the information
<i>(n,v,a)</i> in quite different forms and pattern extraction is necessary. When making a
promise about a specific package, the cfengine user may choose one or the other model.

   <p><b>Smart and dumb package systems</b>

   <p>Package managers vary enormously in their capabilities and in the
kinds of promises they make. There are broadly two types

     <ul>
<li>Smart package systems tha resolve dependencies and require only a symbolic package name. 
<li>Dumb package managers that do not resolve dependencies and need filename input. 
</ul>

   <p>Normal ordering for packages is the following:

     <ul>
<li>Delete
<li>Add
<li>Upgrade
<li>Patch
</ul>

   <p><b>Promise repair logic</b>

   <p>We can discuss package promise repair in the following table.

   <div class="block-image"><img src="package-behaviour.png" alt="Promise repair logic for packages."></div>

   <p><br>

<pre class="verbatim">
bundle agent packages
{
vars:

 # Test the simplest case -- leave everything to the yum smart manager

 "match_package" slist => { 
                          "apache2", 
                          "apache2-mod_php5",
                          "apache2-prefork",
                          "php5" 
                          };
packages:

  "$(match_package)"

     package_policy => "add",
     package_method => yum;

}

</pre>

   <p><br>

   <p>Packages promises can be very simple if the package manager is of the
smart variety that handles details for you. If you need to specify
architecture and version numbers of packages, this adds some
complexity, but the options are flexible and designed for maximal
adaptability.

<p class="noindent"><b>Patching</b>

   <p>Some package systems also support the idea of `patches'. These might
be formally different objects to packages. A patch might contain
material for several packages and be numbered differently. 
When you select patching-policy the package name (promiser) can be
a regular expression that will match possible patch names, otherwise
identifying specific patches can be cumbersome.

   <p>Note that patching is a subtle business. There is no simple way using
the patch settings to install `all new system patches'. Here's why:

   <p>If we specify the name of a patch, then cfengine will try to see if it
exists and/or is installed. If it exists in the pending list, it will
be installed.  If it exists in the installed list it will not be
installed. Now consider the pattern &lsquo;<samp><span class="samp">.*</span></samp>&rsquo;. This will match any
installed package, so cfengine will assume the relevant patch has been
installed already.  On the other hand, the pattern &lsquo;<samp><span class="samp">no match</span></samp>&rsquo;
will not match an installed patch, but it will not match a named patch
either.

   <p>Some systems provide a command to do this, which can be specified
without specific patch arguments. If so, that command can be called
periodically under <code>commands</code>. The main purposes of patching
body items are:

     <ul>
<li>To install specific named patches in a controlled manner. 
<li>To generate reports of available and installed patches during
system reporting. 
</ul>

<p class="noindent"><b>Installers without package/patch arguments</b>

   <p>Cfengine supports the syntax &lsquo;<samp><span class="samp">$</span></samp>&rsquo; at the end of a command to mean
that no package name arguments should be used or appended after the
dollar.  This is because some commands require a list of packages,
while others require an empty list. The default behaviour is to try to
append the name of one or more packages to the command, depending on
whether the policy is for individual or bulk installation.

<ul class="menu">
<li><a accesskey="1" href="#package_005farchitectures-in-packages">package_architectures in packages</a>
<li><a accesskey="2" href="#package_005fmethod-in-packages">package_method in packages</a>
<li><a accesskey="3" href="#package_005fpolicy-in-packages">package_policy in packages</a>
<li><a accesskey="4" href="#package_005fselect-in-packages">package_select in packages</a>
<li><a accesskey="5" href="#package_005fversion-in-packages">package_version in packages</a>
</ul>

<div class="node">
<p><hr>
<a name="package_architectures-in-packages"></a>
<a name="package_005farchitectures-in-packages"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#package_005fmethod-in-packages">package_method in packages</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#packages-in-agent-promises">packages in agent promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#packages-in-agent-promises">packages in agent promises</a>

</div>

<h4 class="subsection">7.10.1 <code>package_architectures</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: Select the architecture for package selection

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">packages:

  "$(exact_package)"

     package_policy => "add",
     package_method => rpm,
     package_architectures => { "x86_64" };

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>It is possible to specify a list of packages of different architectures if it is desirable to
install multiple architectures on the host. If no value is specified, cfengine makes no promise
about the result; the package manager's behaviour prevails.

<div class="node">
<p><hr>
<a name="package_method-in-packages"></a>
<a name="package_005fmethod-in-packages"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#package_005fpolicy-in-packages">package_policy in packages</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#package_005farchitectures-in-packages">package_architectures in packages</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#packages-in-agent-promises">packages in agent promises</a>

</div>

<h4 class="subsection">7.10.2 <code>package_method</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>package_add_command</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

     <p class="noindent"><b>Synopsis</b>: Command to install a package to the system

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body package_method rpm
     {
     package_add_command => "/bin echo /bin/rpm -i ";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This command should install a package when appended with the package referernce id, formed
using the <code>package_name_convention</code>, using the model of (name,version,architecture).

     <br><dt>&lsquo;<samp><code>package_arch_regex</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Regular expression with one backreference to extract package architecture string

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body package_method rpm
     
     {
     package_list_arch_regex    => "[^.]+\.([^.]+)";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This is for use when extracting architecture from the name of the
promiser, i.e. when the architecture is not specified using the
<code>package_architectures</code> list.  It is a regular expression that
contains exactly one back reference (parenthesis) which marks the
location in the <i>promiser</i> at which the architecture is
specified. If no architecture is specified for the given package
manager, then do not define this.

     <br><dt>&lsquo;<samp><code>package_changes</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>individual</code>
                    <code>bulk</code>
                    <code>bulk_no_names</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Menu option - whether to group packages into a single aggregate command

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body package_method rpm
     
     {
     package_changes => "bulk";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>
This indicate whether the package manager is capable of handling
package operations in bulk, i.e. with by given multiple arguments. If
this is set to &lsquo;<samp><span class="samp">bulk</span></samp>&rsquo; then multiple arguments will be passed to
the package commands. If set to &lsquo;<samp><span class="samp">individual</span></samp>&rsquo; packages will be
handled one by one. This might add a significant overhead to the
operations, and also affect the ability of the operating system's
package manager to handle dependencies.

     <br><dt>&lsquo;<samp><code>package_delete_command</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

     <p class="noindent"><b>Synopsis</b>: Command to remove a package from the system

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body package_method rpm
     
     {
     package_delete_command => "/bin/rpm -e --nodeps";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The command that deletes a package from the system when appended with the package reference
identifier specified by <code>package_name_convention</code>.

     <br><dt>&lsquo;<samp><code>package_file_repositories</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: A list of machine-local directories to search for packages

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body package_method filebased
     {
     file_repositories => { "/package/repos1", "/packages/repos2" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>If specified, cfengine will assume that the package installation occurs by filename and will
search the named paths for a package matching the pattern <code>package_name_convention</code>. 
If found the name will be prefixed to the package name in the package commands.

     <br><dt>&lsquo;<samp><code>package_installed_regex</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Regular expression which matches packages that are already installed

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body package_method yum
     {
     package_installed_regex => ".*installed.*";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This regular expression should match lines in the output of the list command that are
actually installed packages. If all the lines match then it can be set of &lsquo;<samp><span class="samp">.*</span></samp>&rsquo;,
however most package systems output prefix lines and a variety of human padding that
needs to be ignored.

     <br><dt>&lsquo;<samp><code>package_list_command</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

     <p class="noindent"><b>Synopsis</b>: Command to obtain a list of installed packages

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body package_method rpm
     
     {
     package_list_command => "/bin/rpm -qa --queryformat \"%{name} %{version}-%{release}\n\"";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This command should provide a complete list of the packages installed on the system. 
It might also list packages that are not installed. Those should be filtered out using
the <code>package_installed_regex</code>.

     <br><dt>&lsquo;<samp><code>package_list_version_regex</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Regular expression with one backreference to extract package version string

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     body package_method rpm
     
     {
     package_list_version_regex => "[^\s]+ ([^.]+).*";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This regular expression should containe exactly one back-reference (parenthesis)
that marks the version string of packages listed as installed.

     <br><dt>&lsquo;<samp><code>package_list_name_regex</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Regular expression with one backreference to extract package name string

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body package_method rpm
     
     {
     package_list_name_regex    => "([^\s]+).*";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This regular expression should contain a single back reference (parenthesis)
that marks the name of the package from the package listing.

     <br><dt>&lsquo;<samp><code>package_list_arch_regex</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Regular expression with one backreference to extract package architecture string

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body package_method rpm
     {
     package_list_arch_regex    => "[^|]+\|[^|]+\|[^|]+\|[^|]+\|\s+([^\s]+).*";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>A regular expression that contains exactly one back reference
(parenthesis) which marks the location in the listed package at which the
architecture is specified. If no architecture is specified for the
given package manager, then do not define this.

     <br><dt>&lsquo;<samp><code>package_name_convention</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: This is how the package manager expects the file to be referred to, e.g. $(name).$(arch)

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     body package_method rpm
     
     {
     package_name_convention => "$(name).$(arch).rpm";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This sets the pattern for naming the package in the way expected by
the package manager. Three special variables are defined from the
extracted data, in a private context for use: &lsquo;<samp><span class="samp">$(name)</span></samp>&rsquo;,
&lsquo;<samp><span class="samp">$(version)</span></samp>&rsquo; and &lsquo;<samp><span class="samp">$(arch)</span></samp>&rsquo;.

     <br><dt>&lsquo;<samp><code>package_name_regex</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Regular expression with one backreference to extract package name string

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body package_method rpm
     {
     package_name_regex => "([^\s]).*";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This regular expression is only used when the <i>promiser</i> contains
not only the name of the package, but its version and archiecture
also. In that case, this expression should contain a single back-reference
(parenthesis) to extract the name of the package from the string.

     <br><dt>&lsquo;<samp><code>package_noverify_regex</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Regular expression to match verification failure output

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     body package_method xyz
     
     {
     # package_noverify_regex => ".*problem.*";
     
     package_noverify_regex => ".*[^\s].*";   # some non-zero output
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>A regular expression to match output from a package verification command. If the
ourput string matches this expression, the package is deemed broken.

     <br><dt>&lsquo;<samp><code>package_noverify_returncode</code></samp>&rsquo;<dd><b>Type</b>: int

     <p class="noindent"><b>Allowed input range</b>: <code>-99999999999,9999999999</code>

     <p class="noindent"><b>Synopsis</b>: Integer return code indicating package verification failure

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     body package_method xyz
     {
     package_noverify_returncode => "-1";
     }
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>For use if a package verification command uses the return code as the signal
for a failed package verification.

     <br><dt>&lsquo;<samp><code>package_patch_arch_regex</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Regular expression with one backreference to extract update architecture string

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body package_method zypper
     {
     package_patch_arch_regex => "";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>A few package managers keep a separate notion of patches, as opposed to package updates. 
OpenSuSE, for example, is one of these. This provide an analogous command struct to the
packages for patch updates.

     <br><dt>&lsquo;<samp><code>package_patch_command</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

     <p class="noindent"><b>Synopsis</b>: Command to update to the latest patch release of an installed package

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     body package_method zypper
     
     {
     package_patch_command => "/usr/bin/zypper -non-interactive patch";
     }
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>If the package manager supports patching, this command should patch a
named package. If only patching of all packages is supported then consider running
that as a batch operation in <code>commands</code>. Alternatively one can end the command
string with a &lsquo;<samp><span class="samp">$</span></samp>&rsquo; symbol, which cfengine will interpret as an instruction to
not append package names.

     <br><dt>&lsquo;<samp><code>package_patch_installed_regex</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Regular expression which matches packages that are already installed

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body package_method zypper
     {
     package_patch_installed_regex => ".*Installed.*|.*Not Applicable.*";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>A few package managers keep a separate notion of patches, as opposed to package updates. 
OpenSuSE, for example, is one of these. This provide an analogous command struct to the
packages for patch updates.

     <br><dt>&lsquo;<samp><code>package_patch_list_command</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

     <p class="noindent"><b>Synopsis</b>: Command to obtain a list of available patches or updates

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
      package_patch_list_command => "/usr/bin/zypper patches";
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This command, if it exists at all, is presumed to generate a list of
available patches in a format analogous to (but not necessarily the
same as) the package-list command, of patches that are available
on the system. Patches might formally be available in the packagae
manager's view, but if they have already been installed, cfengine will
ignore them.

     <br><dt>&lsquo;<samp><code>package_patch_name_regex</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Regular expression with one backreference to extract update name string

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body package_method zypper
     {
     package_patch_name_regex    => "[^|]+\|\s+([^\s]+).*";
     }
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>A few package managers keep a separate notion of patches, as opposed to package updates. 
OpenSuSE, for example, is one of these. This provide an analogous command struct to the
packages for patch updates.

     <br><dt>&lsquo;<samp><code>package_patch_version_regex</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Regular expression with one backreference to extract update version string

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body package_method zypper
     {
     package_patch_version_regex => "[^|]+\|[^|]+\|\s+([^\s]+).*";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>A few package managers keep a separate notion of patches, as opposed to package updates. 
OpenSuSE, for example, is one of these. This provide an analogous command struct to the
packages for patch updates.

     <br><dt>&lsquo;<samp><code>package_update_command</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

     <p class="noindent"><b>Synopsis</b>: Command to update to the latest version a currently installed package

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body package_method zypper
     {
     package_update_command => "/usr/bin/zypper -non-interactive update";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>If supported this should be a command that updates the version of a
single currently installed package. If only bulk updates are supported, consider running
this as a single command under <code>commands</code>.

     <br><dt>&lsquo;<samp><code>package_verify_command</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

     <p class="noindent"><b>Synopsis</b>: Command to verify the correctness of an installed package

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     body package_method rpm
     
     {
     package_verify_command => "/bin/rpm -V";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>If available, this is a command to verify an already installed
package. Such commands are not necessarily meaningful in the context
of a tool like cfengine which patches the system by `other means'.

     <br><dt>&lsquo;<samp><code>package_version_regex</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Regular expression with one backreference to extract package version string

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body package_method rpm
     {
     package_version_regex => "[^\s]+ ([^.]+).*";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>If the version of a package is not specified separately using
<code>package_version</code>, then this should be a regular expression that
contains exactly one back-reference that matches the version string in the promiser.

   </dl>

<div class="node">
<p><hr>
<a name="package_policy-in-packages"></a>
<a name="package_005fpolicy-in-packages"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#package_005fselect-in-packages">package_select in packages</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#package_005fmethod-in-packages">package_method in packages</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#packages-in-agent-promises">packages in agent promises</a>

</div>

<h4 class="subsection">7.10.3 <code>package_policy</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>add</code>
               <code>delete</code>
               <code>reinstall</code>
               <code>update</code>
               <code>patch</code>
               <code>verify</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: Criteria for package installation/upgrade on the current system

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">packages:

  "$(match_package)"

     package_policy => "add",
     package_method => "xyz";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This decides what fate is intended for the named package.

<div class="node">
<p><hr>
<a name="package_select-in-packages"></a>
<a name="package_005fselect-in-packages"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#package_005fversion-in-packages">package_version in packages</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#package_005fpolicy-in-packages">package_policy in packages</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#packages-in-agent-promises">packages in agent promises</a>

</div>

<h4 class="subsection">7.10.4 <code>package_select</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>&gt;</code>
               <code>&lt;</code>
               <code>==</code>
               <code>!=</code>
               <code>&gt;=</code>
               <code>&lt;=</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: A criterion for first acceptable match relative to "package_version"

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">packages:

  "$(exact_package)"

     package_policy => "add",
     package_method => xyz,
     package_select => ">=",
     package_architectures => { "x86_64" },
     package_version => "1.2.3-456";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This selects the operator that compares the promiser to the state of the system
packages currently installed. If the criterion matches, the policy action is
scheduled for promise-keeping.

<div class="node">
<p><hr>
<a name="package_version-in-packages"></a>
<a name="package_005fversion-in-packages"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#package_005fselect-in-packages">package_select in packages</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#packages-in-agent-promises">packages in agent promises</a>

</div>

<h4 class="subsection">7.10.5 <code>package_version</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: Version reference point for determining promised version

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">packages:

  "mypackage"

     package_policy => "add",
     package_method => rpm,
     package_select => "=",
     package_version => "1.2.3";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Used for specifying the targeted package version when the version is written
separately from the name of the command.

<div class="node">
<p><hr>
<a name="processes-in-agent-promises"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#storage-in-agent-promises">storage in agent promises</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#packages-in-agent-promises">packages in agent promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-agent">Bundles for agent</a>

</div>

<h3 class="section">7.11 <code>processes</code> promises in &lsquo;<samp><span class="samp">agent</span></samp>&rsquo;</h3>

<p><br>

   <p>Process promises refer to items in the system process table. Note that
this is not the same as commands (which are instructions). A process
is a command in some state of execution (with a Process Control
Block).  Promiser objects here are patterns that match line fragments
in the system process table.

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
      processes:
     
        "<var>regex contained in process line</var>"
     
            process_select =&gt; <var>process_filter_body</var>,
            restart_class =&gt; "activation class for process",
            ..;
     
</pre>
   </td></tr></table>

   <p>In cfengine 2 there was a restart clause for directly executing a
command to restart a process. In cfengine 3 there is instead
a class to activate. You must then desribe a <code>command</code> in that
class to restart the process.

<pre class="verbatim">
commands:

  restart_me::

   "/path/executable" ... ;

</pre>
This rationalizes complex restart-commands and avoids unnecessary overlap
between <code>processes</code> and <code>commands</code>.

   <p>The <code>process_stop</code> is also arguably a command, but it should be
an ephemeral command that does not lead to a persistent process. It is
intended only for commands of the form &lsquo;<samp><span class="samp">/etc/inetd service stop</span></samp>&rsquo;, not
for processes that persist. Processes are restarted at the end of a bundle's
execution, but stop commands are executed immediately.

   <p><i>Take care to note that process table formats differ between operating systems,
and the use of simple patterns such as program-names is recommended. For
more sophisticated matches, users should use the </i><code>process_select</code><i>
feature.</i>

   <p>Note: <code>process_select</code> was previously called process <code>filters</code> in
cfengine 2 and earlier.

   <p><br>

<pre class="verbatim">
bundle agent example
{
processes:

 ".*"

    process_count   => anyprocs,
    process_select  => proc_finder;

reports:

 any_procs::

   "Found processes out of range";
}

########################################################

body process_select proc_finder

{
stime_range => irange(ago(0,0,0,5,30,0),ago(0,0,0,0,20,0));
process_result => "stime";
}

########################################################

body process_count anyprocs

{
match_range => "0,0";
out_of_range_define => { "any_procs" };
}

</pre>

   <p><br>

   <p>In cfengine 2, one has two separate actions:

<pre class="smallexample">      processes
      shellcommands
</pre>
   <p class="noindent">In cfengine 3 we have

<pre class="smallexample">      processes
      commands
</pre>
   <p>Cfengine 2 got this ontology about right intuitively, but not
quite. It allowed a &lsquo;<samp><span class="samp">restart</span></samp>&rsquo; command to appear in a process
promise, which is really a command execution. This has been
changed in cfengine 3 so that there is a cleaner separation. Let's see
why.

   <p>Executions are about jobs, services, scripts etc. They are properties
of an executable file. The referring `promiser' is a file
object. On the other hand a process is a property of a "process
identifier" which is a kernel instantiation, a quite different object
altogether. So it makes sense to say that

     <ul>
<li>A "PID" (which is not an executable) promises to be reminded of a signal, e.g.
     <pre class="smallexample">              kill signal pid
</pre>
     <li>An "command" promises to start or stop itself with a parameterized specification.
     <pre class="smallexample">              exec command argument1 argument2 ...
</pre>
     </ul>

   <p>Neither the file nor the pid necessarily promise to respond to these activations, but they
are nonetheless physically meaningful phenomena or attributes associated with these objects.

     <ul>
<li>Executable files do not listen for signals as they have no active state. 
<li>PIDs do not run themselves or stop themselves with new arguments, but they can use signals as they are running. 
</ul>

   <p>Executions lead to processes for the duration of their lifetime, so these two issues
are related, although the promises themselves are not.

   <p><br>
<b>Services verus processes</b>:
<br>

   <p>A service is an abstraction that requires processes to run and files
to be configured. It makes a lot of sense to wrap services in modular
bundles. Starting and stopping a service can be handled in at least two ways. 
Take the web service as an example.

   <p>We can start the service by promising an execution of a daemon (e.g. <code>httpd</code>). 
Normally this execution does not terminate without intervention. We can
terminate it in one of two ways:

     <ul>
<li>Using a process signal, by promising a signal to processes matching a certain pid search
<li>Using an execution of a termination command, e.g. &lsquo;<samp><span class="samp">/etc/init.d/apache stop</span></samp>&rsquo;. 
</ul>

   <p>The first case makes sense if we need to qualify the termination by
searching for the processes. The processes section of a cfengine 3
policy includes a control promise to search for matching processes. 
If matches are found, signals can be sent to precisely each specific process.

   <p>Classes can also be defined, in principle triggering an execution of
the stop script, but then the class refers only to the presence of
matching pids, not to the individual pids concerned.  So it becomes
the responsibility of the execution to locate and interact with the
pids necessary.

   <p><br>
<b>Want it running?</b>:
<br>

   <p>How do we say simply that we want a service running? 
In the agent control promises, we could check each service
individually.
<pre class="verbatim">bundlesequence => { Update, Service("apache"), Service("nfsd") };
</pre>
or
<pre class="verbatim">bundlesequence => { Update, @(globals.all_services)  };
</pre>

   <p>The bundle for this can look like this:
<pre class="verbatim">bundle agent Service("$(service)")

{
processes:

  "$(service)" 

      process_count => up("$(service)");

commands:

   "$daemons[$(service)]"  

      ifvarclass => "$(service)_up",
      args       => "$args[$(service)]";

}
</pre>

   <p>An alternative would be self-contained:

<pre class="verbatim">bundle agent Service

{
vars:

  "service" slist => { "apache", "nfsd", "bind" };

processes:

  "$(service)" 

      process_count => up("$(service)");

commands:

   "$daemons[$(service)]"  

      ifvarclass => "$(service)_up",
      args       => "$args[$(service)]";

}

######################
# Parameterized body
######################

body process_count("$(s)")

{
match_range => "[0,10]";
out_of_range_define => "$(s)_up";
}

</pre>

   <p>Is this a step backwards? 
The cfengine 3 approach might seem like a step backwards from the simple cfengine 2 statement:
<pre class="verbatim">processes:

  "httpd" restart "/etc/init.d/apache restart"
</pre>

   <p>However, it allows several improvements.

   <p>You can do other things in between stopping and starting the service,
like file editing, or security sweeps.  You can use templates to
simplify the syntax in bulk for several process checks or restarts.

<pre class="verbatim">processes:

  "$(service.list)"

</pre>
If you don't want any delay in stopping and starting the service, then
place these promises in a private bundle with nothing in between them.

<ul class="menu">
<li><a accesskey="1" href="#process_005fcount-in-processes">process_count in processes</a>
<li><a accesskey="2" href="#process_005fselect-in-processes">process_select in processes</a>
<li><a accesskey="3" href="#process_005fstop-in-processes">process_stop in processes</a>
<li><a accesskey="4" href="#restart_005fclass-in-processes">restart_class in processes</a>
<li><a accesskey="5" href="#signals-in-processes">signals in processes</a>
</ul>

<div class="node">
<p><hr>
<a name="process_count-in-processes"></a>
<a name="process_005fcount-in-processes"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#process_005fselect-in-processes">process_select in processes</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#processes-in-agent-promises">processes in agent promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#processes-in-agent-promises">processes in agent promises</a>

</div>

<h4 class="subsection">7.11.1 <code>process_count</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>in_range_define</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: List of classes to define if the matches are in range

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body process_count example
     {
     in_range_define => { "class1", "class2" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Classes are defined if the processes that are found in the process table satisfy the
promised process count, i.e. if the promise about the number of processes matching
the other criteria is kept.

     <br><dt>&lsquo;<samp><code>match_range</code></samp>&rsquo;<dd><b>Type</b>: irange [int,int]

     <p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

     <p class="noindent"><b>Synopsis</b>: Integer range for acceptable number of matches for this process

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body process_count example
     {
     match_range => irange("10","50");
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This is a numerical range for the number of occurrences of the
process in the process table. As long as it falls within the specified
limits, the promise is considered kept.

     <br><dt>&lsquo;<samp><code>out_of_range_define</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: List of classes to define if the matches are out of range

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body process_count example(s)
     {
     out_of_range_define => { "process_anomaly", "anomaly_$(s)"};
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Classes to activate remedial promises conditional on this promise failure
to be kept.

   </dl>

<div class="node">
<p><hr>
<a name="process_select-in-processes"></a>
<a name="process_005fselect-in-processes"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#process_005fstop-in-processes">process_stop in processes</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#process_005fcount-in-processes">process_count in processes</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#processes-in-agent-promises">processes in agent promises</a>

</div>

<h4 class="subsection">7.11.2 <code>process_select</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>command</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Regular expression matching the command/cmd field of a process

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body select_process example
     
     {
     command => "cf-.*";
     
     process_result => "command";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This expression should match the entire <code>COMMAND</code> field of the
process table (not just a fragment). This field is usually the last
field on the line and thus starts with the first non-space character
and ends with the end of line.

     <br><dt>&lsquo;<samp><code>pid</code></samp>&rsquo;<dd><b>Type</b>: irange [int,int]

     <p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

     <p class="noindent"><b>Synopsis</b>: Range of integers matching the process id of a process

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body process_select example
     {
     ppid => irange("1","10");
     process_result => "ppid";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <br><dt>&lsquo;<samp><code>pgid</code></samp>&rsquo;<dd><b>Type</b>: irange [int,int]

     <p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

     <p class="noindent"><b>Synopsis</b>: Range of integers matching the parent group id of a process

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body process_select example
     {
     pgid => irange("1","10");
     process_result => "pgid";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <br><dt>&lsquo;<samp><code>ppid</code></samp>&rsquo;<dd><b>Type</b>: irange [int,int]

     <p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

     <p class="noindent"><b>Synopsis</b>: Range of integers matching the parent process id of a process

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body process_select example
     {
     ppid => irange("407","511");
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <br><dt>&lsquo;<samp><code>priority</code></samp>&rsquo;<dd><b>Type</b>: irange [int,int]

     <p class="noindent"><b>Allowed input range</b>: <code>-20,+20</code>

     <p class="noindent"><b>Synopsis</b>: Range of integers matching the priority field (PRI/NI) of a process

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body process_select example
     {
     priority => irange("-5","0");
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <br><dt>&lsquo;<samp><code>process_owner</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: List of regexes matching the user of a process

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body process_select example
     {
     process_owner => { "wwwrun", "nobody" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Regular expression should match a legal user name on the system.

     <br><dt>&lsquo;<samp><code>process_result</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[(process_owner|pid|ppid||pgid|rsize|vsize|status|command|ttime|stime|tty|priority|threads)[|&amp;!.]*]*</code>

     <p class="noindent"><b>Synopsis</b>: Boolean class expression returning the logical combination of classes set by a process selection test

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body process_select proc_finder(p)
     
     {
     process_owner  => { "avahi", "bin" };
     command        => "$(p)";
     pid            => "100,199";
     vsize          => "0,1000";
     process_result => "command.(process_owner|rsize)";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>A logical combination of the process selection classifiers. The syntax
is the same as that for class expressions. There should be no spaces
in the expressions.

     <br><dt>&lsquo;<samp><code>rsize</code></samp>&rsquo;<dd><b>Type</b>: irange [int,int]

     <p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

     <p class="noindent"><b>Synopsis</b>: Range of integers matching the resident memory size of a process

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body process_select
     {
     rsize => irange("4000","8000");
     }
     
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <br><dt>&lsquo;<samp><code>status</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Regular expression matching the status field of a process

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body process_select example
     {
     status => "Z";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>For instance, characters in the set &lsquo;<samp><span class="samp">NRS&lt;sl+..</span></samp>&rsquo;

     <br><dt>&lsquo;<samp><code>stime_range</code></samp>&rsquo;<dd><b>Type</b>: irange [int,int]

     <p class="noindent"><b>Allowed input range</b>: <code>0,2147483647</code>

     <p class="noindent"><b>Synopsis</b>: Range of integers matching the start time of a process

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body process_select example
     {
     stime_range => irange(ago(0,0,0,1,0,0,),now);
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The calculation of time from process table entries is sensitive to
Daylight Savings Time (Summer/Winter Time) so calculations could be a
hour off. This is for now a bug to be fixed.

     <br><dt>&lsquo;<samp><code>ttime_range</code></samp>&rsquo;<dd><b>Type</b>: irange [int,int]

     <p class="noindent"><b>Allowed input range</b>: <code>0,2147483647</code>

     <p class="noindent"><b>Synopsis</b>: Range of integers matching the total elapsed time of a process

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body process_select example
     {
     ttime_range => irange(0,accumulated(0,1,0,0,0,0));
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This is total accumulated time for a process.

     <br><dt>&lsquo;<samp><code>tty</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Regular expression matching the tty field of a process

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body process_select example
     {
     tty => "pts/[0-9]+";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <br><dt>&lsquo;<samp><code>threads</code></samp>&rsquo;<dd><b>Type</b>: irange [int,int]

     <p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

     <p class="noindent"><b>Synopsis</b>: Range of integers matching the threads (NLWP) field of a process

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body process_select example
     {
     threads => irange(1,5);
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <br><dt>&lsquo;<samp><code>vsize</code></samp>&rsquo;<dd><b>Type</b>: irange [int,int]

     <p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

     <p class="noindent"><b>Synopsis</b>: Range of integers matching the virtual memory size of a process

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body process_select example
     {
     vsize => irange("4000","9000");
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

   </dl>

<div class="node">
<p><hr>
<a name="process_stop-in-processes"></a>
<a name="process_005fstop-in-processes"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#restart_005fclass-in-processes">restart_class in processes</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#process_005fselect-in-processes">process_select in processes</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#processes-in-agent-promises">processes in agent promises</a>

</div>

<h4 class="subsection">7.11.3 <code>process_stop</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

<p class="noindent"><b>Synopsis</b>: A command used to stop a running process

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
processes:

 "snmpd"

        process_stop => "/etc/init.d/snmp stop";


</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>As an alternative to sending a termination or kill signal to a process,
one may call a `stop script' to perform a graceful shutdown.

<div class="node">
<p><hr>
<a name="restart_class-in-processes"></a>
<a name="restart_005fclass-in-processes"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#signals-in-processes">signals in processes</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#process_005fstop-in-processes">process_stop in processes</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#processes-in-agent-promises">processes in agent promises</a>

</div>

<h4 class="subsection">7.11.4 <code>restart_class</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: <code>[a-zA-Z0-9_$.]+</code>

<p class="noindent"><b>Synopsis</b>: A class to be set if the process is not running, so that a command: rule can be referred to restart the process

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
processes:

   "cfservd"

     restart_class => "start_cfserv";

commands:

  start_cfserv::

    "/usr/local/sbin/cfservd";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This is a signal to restart a process that should be running, if it is
not running.  Processes are signalled first and then restarted later,
at the end of bundle execution, after all possible corrective actions have
been made that could influence their execution.

<div class="node">
<p><hr>
<a name="signals-in-processes"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#restart_005fclass-in-processes">restart_class in processes</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#processes-in-agent-promises">processes in agent promises</a>

</div>

<h4 class="subsection">7.11.5 <code>signals</code></h4>

<p class="noindent"><b>Type</b>: (option list)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>hup</code>
               <code>int</code>
               <code>trap</code>
               <code>kill</code>
               <code>pipe</code>
               <code>cont</code>
               <code>abrt</code>
               <code>stop</code>
               <code>quit</code>
               <code>term</code>
               <code>child</code>
               <code>usr1</code>
               <code>usr2</code>
               <code>bus</code>
               <code>segv</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: A list of menu options representing signals to be sent to a process

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
processes:

 cfservd_out_of_control::

   "cfservd"

        signals         => { "stop" , "term" },
        restart_class   => "start_cfserv";

 any::

   "snmpd"

        signals         => { "term" , "kill" };
   
</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Signals are presented as an ordered list to the process.

<div class="node">
<p><hr>
<a name="storage-in-agent-promises"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#processes-in-agent-promises">processes in agent promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-agent">Bundles for agent</a>

</div>

<h3 class="section">7.12 <code>storage</code> promises in &lsquo;<samp><span class="samp">agent</span></samp>&rsquo;</h3>

<p><br>

   <p>Storage promises refer to disks and filesystem properties.

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
      storage:
     
         "/<var>disk volume or mountpoint</var>"
     
           volume =&gt; <var>volume_body</var>,
           ...;
     
</pre>
   </td></tr></table>

   <p>In cfengine 2, storage promises were divided into <code>disks</code> or
<code>required</code>, and <code>misc_mounts</code> types. The old mount-models
for binary and home servers has been deprecated and removed from
cfengine 3. Users who use these models can reconstruct them from the
low-level tools.

   <p><br>

<pre class="verbatim">
bundle agent storage

{
storage:

  "/usr" volume  => mycheck("10%");
  "/mnt" mount   => nfs("nfsserv.example.org","/home");

}

#######################################################

body volume mycheck(free)   # reusable template

{
check_foreign  => "false";
freespace      => "$(free)";
sensible_size  => "10000";
sensible_count => "2";
}

body mount nfs(server,source)

{
mount_type => "nfs";
mount_source => "$(source)";
mount_server => "$(server)";
edit_fstab => "true";
}
</pre>

   <p><br>

<ul class="menu">
<li><a accesskey="1" href="#mount-in-storage">mount in storage</a>
<li><a accesskey="2" href="#volume-in-storage">volume in storage</a>
</ul>

<div class="node">
<p><hr>
<a name="mount-in-storage"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#volume-in-storage">volume in storage</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#storage-in-agent-promises">storage in agent promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#storage-in-agent-promises">storage in agent promises</a>

</div>

<h4 class="subsection">7.12.1 <code>mount</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>edit_fstab</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false add or remove entries to the file system table ("fstab")

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body mount example
     {
     edit_fstab => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The default behaviour is to not place edits in the file system table.

     <br><dt>&lsquo;<samp><code>mount_type</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>nfs</code>
                    <code>nfs2</code>
                    <code>nfs3</code>
                    <code>nfs4</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: Protocol type of remote file system

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body mount example
     {
     mount_type => "nfs3";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This field is mainly for future extensions.

     <br><dt>&lsquo;<samp><code>mount_source</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[cC]:\\.*|/.*</code>

     <p class="noindent"><b>Synopsis</b>: Path of remote file system to mount

     <p><b>Example</b>:<br>
<br>
<pre class="verbatim">     
     body mount example
     {
     mount_source "/location/disk/directory";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This is the location on the remote device, server, SAN etc.

     <br><dt>&lsquo;<samp><code>mount_server</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Hostname or IP or remote file system server

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body mount example
     {
     mount_server => "nfs_host.example.org";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Hostname or IP address, this could be on a SAN.

     <br><dt>&lsquo;<samp><code>mount_options</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: List of option strings to add to the file system table ("fstab")

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     body mount example
     {
     mount_options => { "rw", "acls" };
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This list is concatenated in a form appropriate for the filesystem. The options must be
legal options for the system mount commands.

     <br><dt>&lsquo;<samp><code>unmount</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false unmount a previously mounted filesystem

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body mount example
     {
     unmount => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

   </dl>

<div class="node">
<p><hr>
<a name="volume-in-storage"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#mount-in-storage">mount in storage</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#storage-in-agent-promises">storage in agent promises</a>

</div>

<h4 class="subsection">7.12.2 <code>volume</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>check_foreign</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false verify storage that is mounted from a foreign system on this host

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body volume example
     
     {
     #..
     check_foreign  => "false";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Cfengine will not normally perform sanity checks on filesystems which
are not local to the host. If <code>true</code> it will ignore a partition's
network location and ask the current host to verify storage located
physically on other systems.

     <br><dt>&lsquo;<samp><code>freespace</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>[0-9]+[mb%]</code>

     <p class="noindent"><b>Synopsis</b>: Absolute or percentage minimum disk space that should be available before warning

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body volume example1
     {
     freespace => "10%";
     }
     
     body volume example2
     {
     freespace => "50M";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The amount of freespace that is promised on a storage device. Once
this promise is found not to be kept, warnings are generated.

     <br><dt>&lsquo;<samp><code>sensible_size</code></samp>&rsquo;<dd><b>Type</b>: int

     <p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

     <p class="noindent"><b>Synopsis</b>: Minimum size in bytes that should be used on a sensible-looking storage device

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body volume example
     {
     sensible_size => "20K";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <pre class="verbatim">     
     body volume control
     {
     sensible_size => "20K";
     }
     
</pre>

     <br><dt>&lsquo;<samp><code>sensible_count</code></samp>&rsquo;<dd><b>Type</b>: int

     <p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

     <p class="noindent"><b>Synopsis</b>: Minimum number of files that should be defined on a sensible-looking storage device

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body volume example
     {
     sensible_count => "20";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Files must be readable by the agent, i.e. it is assumed that the agent has privileges
on volumes being checked.

     <br><dt>&lsquo;<samp><code>scan_arrivals</code></samp>&rsquo;<dd><b>Type</b>: (menu option)

     <p class="noindent"><b>Allowed input range</b>: <br>
     <pre class="example">                    <code>true</code>
                    <code>false</code>
                    <code>yes</code>
                    <code>no</code>
                    <code>on</code>
                    <code>off</code>
</pre>
     <p class="noindent"><b>Synopsis</b>: true/false generate pseudo-periodic disk change arrival distribution

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body volume example
     {
     scan_arrivals => "true";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This operation should not be left `on' for more than a single run
(maximum once per week).  It causes cfengine to perform an extensive
disk scan noting the schedule of changes between files. This can be
used for a number of analyses including optimum backup schedule computation.

   </dl>
   <!-- ***************************************************** -->
<!-- * CHAPTER -->
<!-- ***************************************************** -->
<div class="node">
<p><hr>
<a name="Bundles-for-server"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Bundles-for-knowledge">Bundles for knowledge</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Bundles-for-agent">Bundles for agent</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Top">Top</a>

</div>

<h2 class="chapter">8 Bundles of <code>server</code></h2>

<p><br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
     bundle server access_rules()
     
     {
     access:
     
       "/home/mark/PrivateFiles"
     
         admit   =&gt; { ".*\.example\.org" };
     
       "/home/mark/.cfagent/bin/cf-agent"
     
         admit   =&gt; { ".*\.example\.org" };
     
     roles:
     
       ".*"  authorize =&gt; { "mark" };
     }
     
     
</pre>
   </td></tr></table>

   <p><br>

   <p>Bundles in the server describe access promises on specific file and class
objects supplied by the server to clients.

<ul class="menu">
<li><a accesskey="1" href="#access-in-server-promises">access in server promises</a>
<li><a accesskey="2" href="#roles-in-server-promises">roles in server promises</a>
</ul>

<div class="node">
<p><hr>
<a name="access-in-server-promises"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#roles-in-server-promises">roles in server promises</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Bundles-for-server">Bundles for server</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-server">Bundles for server</a>

</div>

<h3 class="section">8.1 <code>access</code> promises in &lsquo;<samp><span class="samp">server</span></samp>&rsquo;</h3>

<p><br>

   <p>Access promises are conditional promises made by the server about file
objects. The promise has two consequences. For file copy requests, the
file becomes transferrable to the remote client according to the
conditions specified in the server promse (i.e. if the connection
encryption requirements are met, and if the client has been granted
appropriate privileges with <code>maproot</code> (like its NFS counterpart)
to be able to see file objects not owned by the server process owner).

   <p>The promise has two mutally exclusive attributes &lsquo;<samp><span class="samp">admit</span></samp>&rsquo; and
&lsquo;<samp><span class="samp">deny</span></samp>&rsquo;. Use of &lsquo;<samp><span class="samp">admit</span></samp>&rsquo; is preferred as mistakes and
omissions can easily be made when excluding from a group.

   <p>When access is granted to a directory, the promise is automatically
given about all of its contents and sub-directories. 
The access promise allows overlapping promises to be made, and these
are kept in a first-come-first-served fashion. Thus file
objects (promisers) should be listed in order of most-specific file
first. In this way, specific promises will override less specific ones.

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
      access:
     
         <var>"/path/file_object"</var>
     
           admit   =&gt; { <var>"hostname"</var>, <var>"ipv4_address"</var>, <var>"ipv6_address"</var>  };
     
     
</pre>
   </td></tr></table>

   <p><br>

<ul class="menu">
<li><a accesskey="1" href="#Access-Example">Access Example</a>
<li><a accesskey="2" href="#admit-in-access">admit in access</a>
<li><a accesskey="3" href="#deny-in-access">deny in access</a>
<li><a accesskey="4" href="#maproot-in-access">maproot in access</a>
<li><a accesskey="5" href="#ifencrypted-in-access">ifencrypted in access</a>
<li><a accesskey="6" href="#resource_005ftype-in-access">resource_type in access</a>
</ul>

<div class="node">
<p><hr>
<a name="Access-Example"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#admit-in-access">admit in access</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#access-in-server-promises">access in server promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#access-in-server-promises">access in server promises</a>

</div>

<h4 class="subsection">8.1.1 Access Example</h4>

<pre class="verbatim">
#########################################################
# Server config
#########################################################

body server control 

{
allowconnects         => { "127.0.0.1" , "::1" };
allowallconnects      => { "127.0.0.1" , "::1" };
trustkeysfrom         => { "127.0.0.1" , "::1" };
}

#########################################################

bundle server access_rules()

{
access:

  "/home/mark/LapTop"

    admit   => { "127.0.0.1" };
}

</pre>

<p><br>

   <p>Entries may be literal addresses of IPv4 or IPv6, or any name registered
in the POSIX <code>gethostbyname</code> service.

<div class="node">
<p><hr>
<a name="admit-in-access"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#deny-in-access">deny in access</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Access-Example">Access Example</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#access-in-server-promises">access in server promises</a>

</div>

<h4 class="subsection">8.1.2 <code>admit</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: List of host names or IP addresses to grant access to file objects

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">access:

  "/home/mark/LapTop"

    admit   => { "127.0.0.1", "192.168.0.1/24", ".*.domain.tld"  };

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Admit promises grant access to file objects on the server. Arguments
may be IP addresses or hostnames, provided DNS name resolution is
active. In order to reach this stage, a client must first have passed
all of the standard connection tests in the control body.

   <p>The lists may contain network addresses in CIDR notation or regular
expressions to match the IP address or name of the connecting host.

<div class="node">
<p><hr>
<a name="deny-in-access"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#maproot-in-access">maproot in access</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#admit-in-access">admit in access</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#access-in-server-promises">access in server promises</a>

</div>

<h4 class="subsection">8.1.3 <code>deny</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: List of host names or IP addresses to deny access to file objects

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
bundle server access_rules()

{
access:

  "/path"

    admit   => { ".*\.example\.org" },
    deny    => { "badhost_1\.example\.org", "badhost_1\.example\.org" };
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Denial is for special exceptions. A better strategy is always to grant
on a need to know basis. A security policy based on exceptions is a
weak one.

<div class="node">
<p><hr>
<a name="maproot-in-access"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#ifencrypted-in-access">ifencrypted in access</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#deny-in-access">deny in access</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#access-in-server-promises">access in server promises</a>

</div>

<h4 class="subsection">8.1.4 <code>maproot</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: List of host names or IP addresses to grant full read-privilege on the server

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
access:

 "/home"

       admit => { "backup_host.example.org" },
 ifencrypted => "true",

     # Backup needs to have access to all users

     maproot => { "backup_host.example.org" };

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Normally users authenticated by the server are granted access only to
files owned by them and no-one else. 
Even if the <code>cf-serverd</code> process runs with root privileges on the
server side of a client-server connection, the client is not automatically
granted access to download files owned by non-privileged users. If <code>maproot</code>
is true then remote <code>root</code> users are granted access to all files.

   <p>A typical case where mapping is important is in making backups of many user
files.

<div class="node">
<p><hr>
<a name="ifencrypted-in-access"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#resource_005ftype-in-access">resource_type in access</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#maproot-in-access">maproot in access</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#access-in-server-promises">access in server promises</a>

</div>

<h4 class="subsection">8.1.5 <code>ifencrypted</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>true</code>
               <code>false</code>
               <code>yes</code>
               <code>no</code>
               <code>on</code>
               <code>off</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: true/false whether the current file access promise is conditional on the connection from the client being encrypted

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
access:

   "/path/file"

    admit     => { ".*.example.org" },
    ifencrypted => "true";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If this flag is true a client cannot access the file object unless
its connection is encrypted.

<div class="node">
<p><hr>
<a name="resource_type-in-access"></a>
<a name="resource_005ftype-in-access"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#ifencrypted-in-access">ifencrypted in access</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#access-in-server-promises">access in server promises</a>

</div>

<h4 class="subsection">8.1.6 <code>resource_type</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>path</code>
               <code>literal</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: The type of object being granted access. The default is access to files.

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">

bundle server access_rules()

{
vars:

  "localvar" string => "literal string";

access:

  "This is a $(localvar) for remote access"
 
        handle  => "test_scalar",
  resource_type => "literal",
        admit   => { "127.0.0.1" };
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>By default, access to resources granted by the server are
files. However, sometimes it is useful to cache <code>literal</code>
strings, hints and data in the server, e.g. the contents of variables,
hashed passwords etc for easy access. In the case of literal data, the
promise handle serves as the reference identifier for queries. Queries
are instigated by function calls by any agent.

<div class="node">
<p><hr>
<a name="roles-in-server-promises"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#access-in-server-promises">access in server promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-server">Bundles for server</a>

</div>

<h3 class="section">8.2 <code>roles</code> promises in &lsquo;<samp><span class="samp">server</span></samp>&rsquo;</h3>

<p><br>

   <p>Roles promises are server-side decisions about which users are allowed
to define soft-classes on the server's system during remote invocation
of <code>cf-agent</code>. This implements a form of Role Based Access
Control (RBAC) for pre-assigned class-promise bindings. The user names
cited must be attached to trusted public keys in order to be accepted.

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
      roles:
     
        "<var>regex</var>"
     
           authorize =&gt; { "<var>usernames</var>", ... };
     
</pre>
   </td></tr></table>

   <p><i>It is worth re-iterating here that it is not possible to send
commands or modify promise definitions by remote access. At best users
may try to send classes when using </i><code>cf-runagent</code><i> in order to
activate sleeping promises. This mechanism limits their ability to
do this</i>.

   <p><br>

<pre class="verbatim">
bundle server access_rules()

{
roles:

  # Allow mark

  "Mark_.*"  authorize => { "mark" };
}

</pre>

   <p><br>

   <p>In this example user &lsquo;<samp><span class="samp">mark</span></samp>&rsquo; is granted permission to remotely
activate classes matching the regular expression when using the
<code>cf-runagent</code> to activate cfengine. In this way one can
implement a form of Role Based Access Control (RBAC), provided
users do not have privileged access on the host directly.

<ul class="menu">
<li><a accesskey="1" href="#authorize-in-roles">authorize in roles</a>
</ul>

<div class="node">
<p><hr>
<a name="authorize-in-roles"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#roles-in-server-promises">roles in server promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#roles-in-server-promises">roles in server promises</a>

</div>

<h4 class="subsection">8.2.1 <code>authorize</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: List of public-key user names that are allowed to activate the promised class during remote agent activation

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
roles:

  ".*"  authorize => { "mark", "marks_friend" };

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Part of Role Based Access Control (RBAC) in cfengine. The users listed
in this section are granted access to set certain classes by using the
remote <code>cf-runagent</code>. The user-names will refer to public key
identities already trusted on the system.

<!-- ***************************************************** -->
<!-- * CHAPTER -->
<!-- ***************************************************** -->
<div class="node">
<p><hr>
<a name="Bundles-for-knowledge"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Bundles-for-monitor">Bundles for monitor</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Bundles-for-server">Bundles for server</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Top">Top</a>

</div>

<h2 class="chapter">9 Bundles of <code>knowledge</code></h2>

<p><br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
     bundle knowledge system
     
     {
     topics:
     
      Troubleshooting::
     
       "Segmentation fault"
            association =&gt; a("is caused by","Bad memory reference","can cause");
     
       "Remote connection problem";
       "Web server not running";
       "Print server not running";
       "Bad memory reference";
     }
     
</pre>
   </td></tr></table>

   <p><br>

   <p>Knowledge bundles describe topic maps, i.e. Topics, Associations and
Occurrences (of topics in documents). This is for knowledge modelling
and has no functional effect on a system.

<ul class="menu">
<li><a accesskey="1" href="#topics-in-knowledge-promises">topics in knowledge promises</a>
<li><a accesskey="2" href="#occurrences-in-knowledge-promises">occurrences in knowledge promises</a>
</ul>

<div class="node">
<p><hr>
<a name="topics-in-knowledge-promises"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#occurrences-in-knowledge-promises">occurrences in knowledge promises</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Bundles-for-knowledge">Bundles for knowledge</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-knowledge">Bundles for knowledge</a>

</div>

<h3 class="section">9.1 <code>topics</code> promises in &lsquo;<samp><span class="samp">knowledge</span></samp>&rsquo;</h3>

<p><br>

   <p>Topic promises are part of the knowledge management engine. A topic is
any string that refers to a concept or subject that we wish to include
in a knowledge base. If a topic has a very long name, it is best to made the
promiser object a short name and use the <code>comment</code> field
to add the long explanation (e.g. unique acronym and full text).

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
      topics:
     
       "<var>topic string</var>"
     
        comment =&gt; "<var>long name..</var>",
        ...;
     
</pre>
   </td></tr></table>

   <p>Topics form associative structures based entirely on an abstract space
of natural language. Actually, this is only slightly more abstract
than files, processes and commands etc. The main difference in
knowledge management is that there are no corrective or maintenance
operations associated with knowledge promises.

   <p>Class membership in knowledge management is subtly different from
other parts of cfengine. If a topic lies in a certain class context,
the topic uses it as a type-label. This is used for disambiguation of
subject-area in searches rather than for disambiguation of rules between
physical environments.

   <p><br>

<pre class="verbatim">
bundle knowledge example
{
topics:

   "Distro"
      comment     => "Distribution of linux",              
      association => a("is a packaging of","Linux","is packaged as a");
}

</pre>

   <p><br>

   <p>Topics are basically identifiers, where the comment field here is a
long form of the subject string. Associations form semantic links
between topics. Topics can appear multiple times in order to form
multiple associations.

<ul class="menu">
<li><a accesskey="1" href="#association-in-topics">association in topics</a>
<li><a accesskey="2" href="#comment-in-topics">comment in topics</a>
</ul>

<div class="node">
<p><hr>
<a name="association-in-topics"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#comment-in-topics">comment in topics</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#topics-in-knowledge-promises">topics in knowledge promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#topics-in-knowledge-promises">topics in knowledge promises</a>

</div>

<h4 class="subsection">9.1.1 <code>association</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>forward_relationship</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Name of forward association between promiser topic and associates

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body association example
     {
     forward_relation => "is bigger than";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <br><dt>&lsquo;<samp><code>backward_relationship</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Name of backward/inverse association from associates to promiser topic

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     body association example
     {
     # ..
     backward_relationship => "is less than";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>Denotes the inverse name which is used to `moralizing' the association graph.

     <br><dt>&lsquo;<samp><code>associates</code></samp>&rsquo;<dd><b>Type</b>: slist

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: List of associated topics by this forward relationship

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body association example(literal,scalar,list)
     
     {
     #...
     associates => { "literal", $(scalar),  @(list)};
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>An element of an association which is a list of topics to which the
current topic is associated.

   </dl>

<div class="node">
<p><hr>
<a name="comment-in-topics"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#association-in-topics">association in topics</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#topics-in-knowledge-promises">topics in knowledge promises</a>

</div>

<h4 class="subsection">9.1.2 <code>comment</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: Retained comment about this promise's real intention

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
comment => "This comment follows the data for reference ...",

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Comments written in code follow the program, they are not merely discarded. 
They appear in reports and error messages.

<div class="node">
<p><hr>
<a name="occurrences-in-knowledge-promises"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#topics-in-knowledge-promises">topics in knowledge promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-knowledge">Bundles for knowledge</a>

</div>

<h3 class="section">9.2 <code>occurrences</code> promises in &lsquo;<samp><span class="samp">knowledge</span></samp>&rsquo;</h3>

<p><br>

   <p>Occurrences are documents or information resources that discuss
topics. An occurrence promise asserts that a particular document of
text resource in fact represents information about one or more topics. 
This is used to construct references to actual information in a topic
map.

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="smallexample">     
      occurrences:
     
        <var>topic_name</var>::
     
          "<var>URL reference or literal string</var>"
     
              represents =&gt; { "<var>sub-topic disambiguator</var>", ... },
              representation =&gt; "<var>literal or url</var>";
     
</pre>
   </td></tr></table>

   <p><br>

<pre class="verbatim">
 Mark_Burgess::

     "http://www.iu.hio.no/~mark"
            represents => { "Home Page" };

 lvalue::

     "A variable identifier, i.e. the left hand side of an '=' association. The promiser in a variable promise."
            represents => { "Definitions" },
            representation => "literal";

 Editing_Files::

 "http://www.cfengine.org/confdir/customizepasswd.html" 
   represents => { "Setting up users" };


</pre>

   <p><br>

   <p>Occurrences are pointers to information about topics. This
might be a literal text string or a URL reference to an external
document.

<ul class="menu">
<li><a accesskey="1" href="#represents-in-occurrences">represents in occurrences</a>
<li><a accesskey="2" href="#representation-in-occurrences">representation in occurrences</a>
<li><a accesskey="3" href="#web_005froot-in-occurrences">web_root in occurrences</a>
<li><a accesskey="4" href="#path_005froot-in-occurrences">path_root in occurrences</a>
</ul>

<div class="node">
<p><hr>
<a name="represents-in-occurrences"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#representation-in-occurrences">representation in occurrences</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#occurrences-in-knowledge-promises">occurrences in knowledge promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#occurrences-in-knowledge-promises">occurrences in knowledge promises</a>

</div>

<h4 class="subsection">9.2.1 <code>represents</code></h4>

<p class="noindent"><b>Type</b>: slist

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: List of subtopics that explains the type(s) of information represented by the occurrence

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
occurrences:

  Promise_Theory::

    "A theory of autonomous actors that offer certainty through promises"

      represents     => { "Definitions" },
      representation => "literal";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The sub-topic or occurrence-type represented by the document reference
in a knowledge base. This string is intended as an annotation to the
reader about the nature of the inforation located in the occurrence
document. It should be used `creatively'.

   <p>If the document type is an image and one of the items in this list is
a url, beginning with either &lsquo;<samp><span class="samp">/</span></samp>&rsquo; or &lsquo;<samp><span class="samp">http</span></samp>&rsquo;, then
<code>cf-know</code> treats the reference as a url to be reached when the
image is clicked on.

<div class="node">
<p><hr>
<a name="representation-in-occurrences"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#web_005froot-in-occurrences">web_root in occurrences</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#represents-in-occurrences">represents in occurrences</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#occurrences-in-knowledge-promises">occurrences in knowledge promises</a>

</div>

<h4 class="subsection">9.2.2 <code>representation</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>literal</code>
               <code>url</code>
               <code>db</code>
               <code>file</code>
               <code>web</code>
               <code>image</code>
               <code>portal</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: How to interpret the promiser string e.g. actual data or reference to data

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">occurrences:

  Promise_Theory::

    "A theory of autonomous actors that offer certainty through promises"

      represents     => { "Definitions" },
      representation => "literal";


</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The form of knowledge representation in a topic map occurrence reference. 
If the type <code>portal</code> is used it assumes that a new website should open in a new
target window.

<div class="node">
<p><hr>
<a name="web_root-in-occurrences"></a>
<a name="web_005froot-in-occurrences"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#path_005froot-in-occurrences">path_root in occurrences</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#representation-in-occurrences">representation in occurrences</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#occurrences-in-knowledge-promises">occurrences in knowledge promises</a>

</div>

<h4 class="subsection">9.2.3 <code>web_root</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: Base URL of the occurrence when rendered as a web-URL (replaces path_root)

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">bundle knowledge demo
{
occurrences:

 mytopic:

   "reports/(.*)/mytopic_file.html"

            represents => { "found in directory $(match.1)" },
            representation => "file",
            path_root => "$(enterprise_start.doc_root)",
            web_root => "";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>When identifying occurrences by searching for files on the local file system,
the web root provides the HTTP prefix for the document root under which we
are searching so that path names can be mapped into URLs, See <a href="#path_005froot-in-occurrences">path_root in occurrences</a>.

<div class="node">
<p><hr>
<a name="path_root-in-occurrences"></a>
<a name="path_005froot-in-occurrences"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#web_005froot-in-occurrences">web_root in occurrences</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#occurrences-in-knowledge-promises">occurrences in knowledge promises</a>

</div>

<h4 class="subsection">9.2.4 <code>path_root</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: Base path of the occurrence when locating file (replaced by web_root)

<p class="noindent"><b>Example</b>:<br>
<br>
<pre class="verbatim">


bundle knowledge demo
{
occurrences:

 mytopic:

   "reports/(.*)/mytopic_file.html"

            represents => { "found in directory $(match.1)" },
            representation => "file",
            path_root => "$(enterprise_start.doc_root)",
            web_root => "";
}    

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>When searching a local file system for document occurrences, the <code>path_root</code>
points to the local file system's name for the document root. This will be
translated into the URL prefix defined by <code>web_root</code>, See <a href="#web_005froot-in-occurrences">web_root in occurrences</a>.

<!-- ***************************************************** -->
<!-- * CHAPTER -->
<!-- ***************************************************** -->
<div class="node">
<p><hr>
<a name="Bundles-for-monitor"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Special-functions">Special functions</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Bundles-for-knowledge">Bundles for knowledge</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Top">Top</a>

</div>

<h2 class="chapter">10 Bundles of <code>monitor</code></h2>

<p><br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>

<pre class="smallexample">     
     bundle monitor example
     {
     measurements:
     
          # Discover disk device information
     
       "/bin/df"
     
           handle =&gt; "free_memory_watch",
           stream_type =&gt; "pipe",
           data_type =&gt; "slist",
           history_type =&gt; "static",
           units =&gt; "device",
           match_value =&gt; file_systems;
     
     
     }
     
</pre>
   </td></tr></table>

   <p>Monitor bundles contain user defined promises for system discovery and monitoring.

   <p><br>

<ul class="menu">
<li><a accesskey="1" href="#measurements-in-monitor-promises">measurements in monitor promises</a>
</ul>

<div class="node">
<p><hr>
<a name="measurements-in-monitor-promises"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Bundles-for-monitor">Bundles for monitor</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Bundles-for-monitor">Bundles for monitor</a>

</div>

<h3 class="section">10.1 <code>measurements</code> promises in &lsquo;<samp><span class="samp">monitor</span></samp>&rsquo;</h3>

<p><br>

   <p><i>These features are available only in Enterprise versions of cfengine.</i>

   <p>Cfengine's monitoring component <code>cf-monitord</code> records a number
of performance data about the system by default. These include
process counts, service traffic, load average and cpu utilization and
temperature when available.

   <p>Cfengine Nova extends this in two ways. First it adds a three year
trend summary based any `shift'-averages. Second, it addd customizable
promises to monitor or log specific quite specific user data through a
generic interface. The end result is to either generate a periodic
time series, like the above mentioned values, or to log the results to
custom-defined reports.

   <p>Cfengine Nova adds a new promise type in bundles for the monitoring
agent. These are written just like all other promises within a bundle
destined for the agent concerned. In this case:

<pre class="verbatim">bundle monitor watch

{
measurements:

  # promises ...

}

</pre>

   <p>It is important to specificy a promise <code>handle</code> for measurement
promises, as the names defined in the handle are used to determine the
name of the log file or variable to which data will be reported. Log
files are created under <samp><span class="file">WORKDIR/state</span></samp>. Data that have no history
type are stored in a special variable context called &lsquo;<samp><span class="samp">mon</span></samp>&rsquo;, analogous
to the system variables in &lsquo;<samp><span class="samp">sys</span></samp>&rsquo;. Thus the values may be used
in other promises in the form <code>$(mon.handle)</code>.

   <p><br>

<pre class="verbatim">
  # Follow a special process over time
  # using cfengine's process cache to avoid resampling

   "/var/cfengine/state/cf_rootprocs"

      handle => "monitor_self_watch",
      stream_type => "file",
      data_type => "int",
      history_type => "none",
      units => "kB",
      match_value => proc_value(".*cf-monitord.*",
        
         "root\s+[0-9.]+\s+[0-9.]+\s+[0-9.]+\s+[0-9.]+\s+([0-9]+).*");


  # Discover disk device information

  "/bin/df"

      handle => "free_memory_watch",
      stream_type => "pipe",
      data_type => "slist",
      history_type => "static",
      units => "device",
      match_value => file_systems;
      # Update this as often as possible

}


</pre>

   <p><br>

   <p>The general pattern of these promises is to decide the source of the information either file or pipe,
determine the data type (integer, string etc.), specify a pattern to match the result in the file stream
and then specify what to do with the result afterwards.

<ul class="menu">
<li><a accesskey="1" href="#stream_005ftype-in-measurements">stream_type in measurements</a>
<li><a accesskey="2" href="#data_005ftype-in-measurements">data_type in measurements</a>
<li><a accesskey="3" href="#history_005ftype-in-measurements">history_type in measurements</a>
<li><a accesskey="4" href="#units-in-measurements">units in measurements</a>
<li><a accesskey="5" href="#match_005fvalue-in-measurements">match_value in measurements</a>
</ul>

<div class="node">
<p><hr>
<a name="stream_type-in-measurements"></a>
<a name="stream_005ftype-in-measurements"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#data_005ftype-in-measurements">data_type in measurements</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#measurements-in-monitor-promises">measurements in monitor promises</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#measurements-in-monitor-promises">measurements in monitor promises</a>

</div>

<h4 class="subsection">10.1.1 <code>stream_type</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>pipe</code>
               <code>file</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: The datatype being collected.

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
stream_type => "pipe";

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Cfengine treats all input using a stream abstraction. The preferred interface is files, since they
can be read without incurring the cost of a process. However pipes from executed commands may also
be invoked.

<div class="node">
<p><hr>
<a name="data_type-in-measurements"></a>
<a name="data_005ftype-in-measurements"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#history_005ftype-in-measurements">history_type in measurements</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#stream_005ftype-in-measurements">stream_type in measurements</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#measurements-in-monitor-promises">measurements in monitor promises</a>

</div>

<h4 class="subsection">10.1.2 <code>data_type</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>counter</code>
               <code>int</code>
               <code>real</code>
               <code>string</code>
               <code>slist</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: The datatype being collected.

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
  "/bin/df"

      handle => "free_disk_watch",
      stream_type => "pipe",

      data_type => "slist",

      history_type => "static",
      units => "device",
      match_value => file_systems,
      action => sample_min(10,15);


</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>When cfengine (Nova) observes data, such as the attached partitions in
the example above, the datatype determines how that data will be
handled.  Integer and real values, counters etc., are recorded as
time-series if the history type is `weekly', or as single values
otherwise. If multiple items are matched by an observation,
e.g. several lines in a file match the given regular expression,
then these can be made into a list by choosing <code>slist</code>, else
the first matching item will be selected.

<div class="node">
<p><hr>
<a name="history_type-in-measurements"></a>
<a name="history_005ftype-in-measurements"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#units-in-measurements">units in measurements</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#data_005ftype-in-measurements">data_type in measurements</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#measurements-in-monitor-promises">measurements in monitor promises</a>

</div>

<h4 class="subsection">10.1.3 <code>history_type</code></h4>

<p class="noindent"><b>Type</b>: (menu option)

<p class="noindent"><b>Allowed input range</b>: <br>
<pre class="example">               <code>weekly</code>
               <code>scalar</code>
               <code>static</code>
               <code>log</code>
</pre>
   <p class="noindent"><b>Synopsis</b>: Whether the data can be seen as a time-series or just an isolated value

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
 "/proc/meminfo"

      handle => "free_memory_watch",
      stream_type => "file",
      data_type => "int",
      history_type => "weekly",
      units => "kB",
      match_value => free_memory;

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

     <dl>
<dt>&lsquo;<samp><span class="samp">scalar</span></samp>&rsquo;<dd>A single value, with compressed statistics is retained. 
<br><dt>&lsquo;<samp><span class="samp">static</span></samp>&rsquo;<dd>The value of the data is not expected to change for the lifetime of the daemon. 
<br><dt>&lsquo;<samp><span class="samp">log</span></samp>&rsquo;<dd>The measured value is logged as an infinite time-series. 
<br><dt>&lsquo;<samp><span class="samp">weekly</span></samp>&rsquo;<dd>A standard cfengine two-dimensional time average (over a weekly period) is retained. 
</dl>

<div class="node">
<p><hr>
<a name="units-in-measurements"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#match_005fvalue-in-measurements">match_value in measurements</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#history_005ftype-in-measurements">history_type in measurements</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#measurements-in-monitor-promises">measurements in monitor promises</a>

</div>

<h4 class="subsection">10.1.4 <code>units</code></h4>

<p class="noindent"><b>Type</b>: string

<p class="noindent"><b>Allowed input range</b>: (arbitrary string)

<p class="noindent"><b>Synopsis</b>: The engineering dimensions of this value or a note about its intent used in plots

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
   "/var/cfengine/state/cf_rootprocs"

      handle => "monitor_self_watch",
      stream_type => "file",
      data_type => "int",
      history_type => "none",
      units => "kB",
      match_value => proc_value(".*cf-monitord.*",
        
         "root\s+[0-9.]+\s+[0-9.]+\s+[0-9.]+\s+[0-9.]+\s+([0-9]+).*");

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This is an arbitary string used in documentation only.

<div class="node">
<p><hr>
<a name="match_value-in-measurements"></a>
<a name="match_005fvalue-in-measurements"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#units-in-measurements">units in measurements</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#measurements-in-monitor-promises">measurements in monitor promises</a>

</div>

<h4 class="subsection">10.1.5 <code>match_value</code> (compound body)</h4>

<p class="noindent"><b>Type</b>: (ext body)

     <dl>
<dt>&lsquo;<samp><code>select_line_matching</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: <code>.*</code>

     <p class="noindent"><b>Synopsis</b>: Regular expression for matching line location

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body match_value example
     {
     select_line_matching => "^Expression match.* whole line$";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>The &lsquo;<samp><span class="samp">^$</span></samp>&rsquo; are not necessary, just remember that the expression must match
a whole line, not a fragment within a line.

     <br><dt>&lsquo;<samp><code>select_line_number</code></samp>&rsquo;<dd><b>Type</b>: int

     <p class="noindent"><b>Allowed input range</b>: <code>0,99999999999</code>

     <p class="noindent"><b>Synopsis</b>: Read from the n-th line of the output (fixed format)

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body match_value find_line
     {
     select_line_number => "2";
     #...
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>This is mutually exclusive with <code>select_line_matching</code>.

     <br><dt>&lsquo;<samp><code>extraction_regex</code></samp>&rsquo;<dd><b>Type</b>: string

     <p class="noindent"><b>Allowed input range</b>: (arbitrary string)

     <p class="noindent"><b>Synopsis</b>: Regular expression that should contain a single backreference for extracting a value

     <p><b>Example</b>:<br>
<br>

     <pre class="verbatim">     
     body match_value free_memory
     {
     select_line_matching => "MemFree:.*";
     extraction_regex => "MemFree:\s+([0-9]+).*";
     }
     
</pre>

     <p><b>Notes</b>:<br>
<br>

     <p>A single backreference should be given to lift the value to be measured out of the text stream.

   </dl>
   <!-- ***************************************************** -->
<!-- * CHAPTER -->
<!-- ***************************************************** -->
<div class="node">
<p><hr>
<a name="Special-functions"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Special-Variables">Special Variables</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Bundles-for-monitor">Bundles for monitor</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Top">Top</a>

</div>

<h2 class="chapter">11 Special functions</h2>

<ul class="menu">
<li><a accesskey="1" href="#Function-accessedbefore">Function accessedbefore</a>
<li><a accesskey="2" href="#Function-accumulated">Function accumulated</a>
<li><a accesskey="3" href="#Function-ago">Function ago</a>
<li><a accesskey="4" href="#Function-canonify">Function canonify</a>
<li><a accesskey="5" href="#Function-changedbefore">Function changedbefore</a>
<li><a accesskey="6" href="#Function-classify">Function classify</a>
<li><a accesskey="7" href="#Function-classmatch">Function classmatch</a>
<li><a accesskey="8" href="#Function-execresult">Function execresult</a>
<li><a accesskey="9" href="#Function-fileexists">Function fileexists</a>
<li><a href="#Function-filesexist">Function filesexist</a>
<li><a href="#Function-getindices">Function getindices</a>
<li><a href="#Function-getgid">Function getgid</a>
<li><a href="#Function-getuid">Function getuid</a>
<li><a href="#Function-groupexists">Function groupexists</a>
<li><a href="#Function-hash">Function hash</a>
<li><a href="#Function-hashmatch">Function hashmatch</a>
<li><a href="#Function-hostrange">Function hostrange</a>
<li><a href="#Function-hostinnetgroup">Function hostinnetgroup</a>
<li><a href="#Function-iprange">Function iprange</a>
<li><a href="#Function-irange">Function irange</a>
<li><a href="#Function-isdir">Function isdir</a>
<li><a href="#Function-isgreaterthan">Function isgreaterthan</a>
<li><a href="#Function-islessthan">Function islessthan</a>
<li><a href="#Function-islink">Function islink</a>
<li><a href="#Function-isnewerthan">Function isnewerthan</a>
<li><a href="#Function-isplain">Function isplain</a>
<li><a href="#Function-isvariable">Function isvariable</a>
<li><a href="#Function-lastnode">Function lastnode</a>
<li><a href="#Function-ldaparray">Function ldaparray</a>
<li><a href="#Function-ldaplist">Function ldaplist</a>
<li><a href="#Function-ldapvalue">Function ldapvalue</a>
<li><a href="#Function-now">Function now</a>
<li><a href="#Function-on">Function on</a>
<li><a href="#Function-peers">Function peers</a>
<li><a href="#Function-peerleader">Function peerleader</a>
<li><a href="#Function-peerleaders">Function peerleaders</a>
<li><a href="#Function-randomint">Function randomint</a>
<li><a href="#Function-readfile">Function readfile</a>
<li><a href="#Function-readintarray">Function readintarray</a>
<li><a href="#Function-readintlist">Function readintlist</a>
<li><a href="#Function-readrealarray">Function readrealarray</a>
<li><a href="#Function-readreallist">Function readreallist</a>
<li><a href="#Function-readstringarray">Function readstringarray</a>
<li><a href="#Function-readstringlist">Function readstringlist</a>
<li><a href="#Function-readtcp">Function readtcp</a>
<li><a href="#Function-regarray">Function regarray</a>
<li><a href="#Function-regcmp">Function regcmp</a>
<li><a href="#Function-registryvalue">Function registryvalue</a>
<li><a href="#Function-regline">Function regline</a>
<li><a href="#Function-reglist">Function reglist</a>
<li><a href="#Function-regldap">Function regldap</a>
<li><a href="#Function-remotescalar">Function remotescalar</a>
<li><a href="#Function-returnszero">Function returnszero</a>
<li><a href="#Function-rrange">Function rrange</a>
<li><a href="#Function-selectservers">Function selectservers</a>
<li><a href="#Function-splayclass">Function splayclass</a>
<li><a href="#Function-splitstring">Function splitstring</a>
<li><a href="#Function-strcmp">Function strcmp</a>
<li><a href="#Function-usemodule">Function usemodule</a>
<li><a href="#Function-userexists">Function userexists</a>
</ul>

<div class="node">
<p><hr>
<a name="Function-accessedbefore"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-accumulated">Function accumulated</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Special-functions">Special functions</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.1 Function accessedbefore</h3>

<p class="noindent"><b>Synopsis</b>: accessedbefore(2 args) returns type class

<p class="noindent">True if arg1 was accessed before arg2 (atime)

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
classes:

  "do_it" and => { accessedbefore("/tmp/earlier","/tmp/later"), "linux" }; 

reports:

  do_it::

    "The secret changes have been accessed after the reference time";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The function accesses the <code>atime</code> fields of a file and makes a comparison.

<pre class="smallexample">     
      touch /tmp/reference
      touch /tmp/secretfile
     
      /usr/local/sbin/cf-agent -f ./unit_accessed_before.cf -K
      R: The secret changes have been accessed after the reference time
     
</pre>
   <div class="node">
<p><hr>
<a name="Function-accumulated"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-ago">Function ago</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-accessedbefore">Function accessedbefore</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.2 Function accumulated</h3>

<p class="noindent"><b>Synopsis</b>: accumulated(6 args) returns type int

<p class="noindent">Convert an accumulated amount of time into a system representation

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
bundle agent testbundle

{
processes:

 ".*"

    process_count   => anyprocs,
    process_select  => proc_finder;

reports:

 any_procs::

   "Found processes in range";
}

########################################################

body process_select proc_finder

{
ttime_range => irange(accumulated(0,0,0,0,2,0),accumulated(0,0,0,0,20,0));
process_result => "ttime";
}

########################################################

body process_count anyprocs

{
match_range => "0,0";
out_of_range_define => { "any_procs" };
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>In the example we look for processes that have accumulated between 2 and 20 minutes of
total run time.

<p class="noindent"><b>ARGUMENTS</b>:

     <dl>
<dt>&lsquo;<samp><span class="samp">Years</span></samp>&rsquo;<dd>The year, e.g. 2009
<br><dt>&lsquo;<samp><span class="samp">Month</span></samp>&rsquo;<dd>The Month, 1-12
<br><dt>&lsquo;<samp><span class="samp">Day</span></samp>&rsquo;<dd>The day 1-31
<br><dt>&lsquo;<samp><span class="samp">Hours</span></samp>&rsquo;<dd>The hour 0-23
<br><dt>&lsquo;<samp><span class="samp">Minutes</span></samp>&rsquo;<dd>The minutes
0-59
<br><dt>&lsquo;<samp><span class="samp">Seconds</span></samp>&rsquo;<dd>The number of seconds 0-59
</dl>

<div class="node">
<p><hr>
<a name="Function-ago"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-canonify">Function canonify</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-accumulated">Function accumulated</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.3 Function ago</h3>

<p class="noindent"><b>Synopsis</b>: ago(6 args) returns type int

<p class="noindent">Convert a time relative to now to an integer system representation

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
bundle agent testbundle

{
processes:

 ".*"

    process_count   => anyprocs,
    process_select  => proc_finder;

reports:

 any_procs::

   "Found processes out of range";
}

########################################################

body process_select proc_finder

{
stime_range => irange(ago(0,0,0,5,30,0),ago(0,0,0,0,20,0));
process_result => "stime";
}

########################################################

body process_count anyprocs

{
match_range => "0,0";
out_of_range_define => { "any_procs" };
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The <code>ago</code> function measures time relative to now.

<p class="noindent"><b>ARGUMENTS</b>:

     <dl>
<dt>&lsquo;<samp><span class="samp">Years</span></samp>&rsquo;<dd>The year, e.g. 2009
<br><dt>&lsquo;<samp><span class="samp">Months</span></samp>&rsquo;<dd>The Month, 1-12
<br><dt>&lsquo;<samp><span class="samp">Days</span></samp>&rsquo;<dd>The day 1-31
<br><dt>&lsquo;<samp><span class="samp">Hours</span></samp>&rsquo;<dd>The hour 0-23
<br><dt>&lsquo;<samp><span class="samp">Minutes</span></samp>&rsquo;<dd>The minutes
0-59
<br><dt>&lsquo;<samp><span class="samp">Seconds</span></samp>&rsquo;<dd>The number of seconds 0-59
</dl>

<div class="node">
<p><hr>
<a name="Function-canonify"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-changedbefore">Function changedbefore</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-ago">Function ago</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.4 Function canonify</h3>

<p class="noindent"><b>Synopsis</b>: canonify(1 args) returns type string

<p class="noindent">Convert an abitrary string into a legal class name

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
commands:

   "/var/cfengine/bin/$(component)"

       ifvarclass => canonify("start_$(component)");

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This is for use in turning arbitrary text into class data.

<div class="node">
<p><hr>
<a name="Function-changedbefore"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-classify">Function classify</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-canonify">Function canonify</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.5 Function changedbefore</h3>

<p class="noindent"><b>Synopsis</b>: changedbefore(2 args) returns type class

<p class="noindent">True if arg1 was changed before arg2 (ctime)

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
classes:

  "do_it" and => { changedbefore("/tmp/earlier","/tmp/later"), "linux" }; 

reports:

  do_it::

    "The derived file needs updating";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Change times include both file permissions and file contents. Comparisons like this are normally
used for updating files (like the `make' command).

<div class="node">
<p><hr>
<a name="Function-classify"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-classmatch">Function classmatch</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-changedbefore">Function changedbefore</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.6 Function classify</h3>

<p class="noindent"><b>Synopsis</b>: classify(1 args) returns type class

<p class="noindent">True if the canonicalization of the argument is a currently defined class

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
classes:

 "i_am_the_policy_host" expression => classify("master.example.org");

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This function returns true of the classification (canonical form) of
the argument is already a defined class. This is useful for
transforming variables into classes for instance. See also <code>canonify()</code>.

<div class="node">
<p><hr>
<a name="Function-classmatch"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-execresult">Function execresult</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-classify">Function classify</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.7 Function classmatch</h3>

<p class="noindent"><b>Synopsis</b>: classmatch(1 args) returns type class

<p class="noindent">True if the regular expression matches any currently defined class

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
classes:

  "do_it" and => { classmatch(".*_cfengine_com"), "linux" }; 

reports:

  do_it::

    "Host matches pattern";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The regular expression is matched against the current list of defined classes.

<div class="node">
<p><hr>
<a name="Function-execresult"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-fileexists">Function fileexists</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-classmatch">Function classmatch</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.8 Function execresult</h3>

<p class="noindent"><b>Synopsis</b>: execresult(2 args) returns type string

<p class="noindent">Execute named command and assign output to variable

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
vars:

  "my_result" string => execresult("/bin/ls /tmp","noshell");

reports:

  linux::

    "Variable is $(my_result)";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The second argument (&lsquo;<samp><span class="samp">useshell</span></samp>&rsquo;/&lsquo;<samp><span class="samp">noshell</span></samp>&rsquo;) decides whether a shell will be used to
encapsulate the command.  This is necessary in order to combine
commands with pipes etc, but remember that each command requires
a new process that reads in files beyond cfengine's control. Thus
using a shell is both a performance hog and a potential security
issue.

   <p>Note: you should never use this function to execute comands that make
changes to the system. Such an operation is beyind cfengine's ability
to guarantee convergence, and on multiple passes and during syntax
verification, these function calls are executed resulting in system
changes that are `covert'. Calls to <code>execresult</code> should be
for discovery and information extraction only.

<div class="node">
<p><hr>
<a name="Function-fileexists"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-filesexist">Function filesexist</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-execresult">Function execresult</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.9 Function fileexists</h3>

<p class="noindent"><b>Synopsis</b>: fileexists(1 args) returns type class

<p class="noindent">True if the named file can be accessed

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
classes:

  "exists" expression => fileexists("/etc/passwd");

reports:

  exists::

    "File exists";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The user must have access permissions to the file for this to work
faithfully.

<div class="node">
<p><hr>
<a name="Function-filesexist"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-getindices">Function getindices</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-fileexists">Function fileexists</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.10 Function filesexist</h3>

<p class="noindent"><b>Synopsis</b>: filesexist(1 args) returns type class

<p class="noindent">True if the named list of files can ALL be accessed

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
vars:

  "mylist" slist => { "/tmp/a", "/tmp/b", "/tmp/c" };

classes:

  "exists" expression => filesexist("@(mylist)");

reports:

  exists::

    "Files exist";

  !exists::

    "Do not exist";

}



</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The user must have access permissions to the file for this to work
faithfully.

<div class="node">
<p><hr>
<a name="Function-getindices"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-getgid">Function getgid</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-filesexist">Function filesexist</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.11 Function getindices</h3>

<p class="noindent"><b>Synopsis</b>: getindices(1 args) returns type slist

<p class="noindent">Get a list of keys to the array whose id is the argument and assign to variable

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
any::

  bundlesequence  => { "testsetvar" };   
}


#######################################################

bundle agent testsetvar

{
vars:

  "v[index_1]" string => "value_1";
  "v[index_2]" string => "value_2";

  "parameter_name" slist => getindices("v");

reports:

  Yr2008::

   "Found index: $(parameter_name)";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Make sure you specify the correct scope when supplying the name of the variable.

<div class="node">
<p><hr>
<a name="Function-getgid"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-getuid">Function getuid</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-getindices">Function getindices</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.12 Function getgid</h3>

<p class="noindent"><b>Synopsis</b>: getgid(1 args) returns type int

<p class="noindent">Return the integer group id of the named group on this host

<p class="noindent"><b>Example</b>:<br>
<br>
<pre class="verbatim">
body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
vars:

  "gid" int => getgid("users");

reports:

  Yr2008::

    "Users gid is $(gid)";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If the named group does not exist, the variable will not be defined.

<div class="node">
<p><hr>
<a name="Function-getuid"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-groupexists">Function groupexists</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-getgid">Function getgid</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.13 Function getuid</h3>

<p class="noindent"><b>Synopsis</b>: getuid(1 args) returns type int

<p class="noindent">Return the integer user id of the named user on this host

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
vars:

  "uid" int => getuid("mark");

reports:

  Yr2008::

    "Users gid is $(uid)";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If the named user is not registered the variable will not be defined.

<div class="node">
<p><hr>
<a name="Function-groupexists"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-hash">Function hash</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-getuid">Function getuid</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.14 Function groupexists</h3>

<p class="noindent"><b>Synopsis</b>: groupexists(1 args) returns type class

<p class="noindent">True if group or numerical id exists on this host

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
classes:

  "gname" expression => groupexists("users");
  "gid"   expression => groupexists("100");

reports:

  gname::

    "Group exists by name";

  gid::

    "Group exists by id";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The group may be specified by name or number.

<div class="node">
<p><hr>
<a name="Function-hash"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-hashmatch">Function hashmatch</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-groupexists">Function groupexists</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.15 Function hash</h3>

<p class="noindent"><b>Synopsis</b>: hash(2 args) returns type string

<p class="noindent">Return the hash of arg1, type arg2 and assign to a variable

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">

body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
vars:

  "md5" string => hash("Cfengine is not cryptic","md5");

reports:

  Yr2008::

    "Hashed to: $(md5)";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Hash functions are extremely sensitive to input. You should not expect
to get the same answer from this function as you would from every other
tool, since it depends on how whitespace and end of file characters are
handled.

<div class="node">
<p><hr>
<a name="Function-hashmatch"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-hostrange">Function hostrange</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-hash">Function hash</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.16 Function hashmatch</h3>

<p class="noindent"><b>Synopsis</b>: hashmatch(3 args) returns type class

<p class="noindent">Compute the hash of arg1, of type arg2 and test if it matches the value in arg 3

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
bundle agent example

{     
classes:

  "matches" expression => hashmatch("/etc/passwd","md5","c5068b7c2b1707f8939b283a2758a691");

reports:

  matches::

    "File has correct version";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="example">     
     (class) hashmatch(<var>file</var>,<var>md5|sha1|crypt</var>,<var>hash-comparison</var>);
     
</pre>
   </td></tr></table>

   <p>This function may be used to determine whether a system has a particular
version of a binary file (e.g. software patch).

<p class="noindent"><b>ARGUMENTS</b>:

     <ul>
<li>The file concerned
<li>The type of hash
<li>A string of the hash to which we expect the file to conform. 
</ul>

<div class="node">
<p><hr>
<a name="Function-hostrange"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-hostinnetgroup">Function hostinnetgroup</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-hashmatch">Function hashmatch</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.17 Function hostrange</h3>

<p class="noindent"><b>Synopsis</b>: hostrange(2 args) returns type class

<p class="noindent">True if the current host lies in the range of enumerated hostnames specified

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">

body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
classes:

  "compute_nodes" expression => hostrange("cpu-","01-32");

reports:

  compute_nodes::

    "No computer is a cluster";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This is a pattern matching function for non-regular (enumerated) expressions.

<div class="node">
<p><hr>
<a name="Function-hostinnetgroup"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-iprange">Function iprange</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-hostrange">Function hostrange</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.18 Function hostinnetgroup</h3>

<p class="noindent"><b>Synopsis</b>: hostinnetgroup(1 args) returns type class

<p class="noindent">True if the current host is in the named netgroup

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
classes:

  "ingroup" expression => hostinnetgroup("my_net_group");

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="Function-iprange"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-irange">Function irange</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-hostinnetgroup">Function hostinnetgroup</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.19 Function iprange</h3>

<p class="noindent"><b>Synopsis</b>: iprange(1 args) returns type class

<p class="noindent">True if the current host lies in the range of IP addresses specified

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
classes:

  "adhoc_group_1" expression => iprange("128.39.89.10-15");
  "adhoc_group_2" expression => iprange("128.39.74.1/23");

reports:

  adhoc_group_1::

    "Some numerology";

  adhoc_group_2::

    "The masked warriors";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Pattern matching based on IP addresses.

<div class="node">
<p><hr>
<a name="Function-irange"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-isdir">Function isdir</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-iprange">Function iprange</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.20 Function irange</h3>

<p class="noindent"><b>Synopsis</b>: irange(2 args) returns type irange [int,int]

<p class="noindent">Define a range of integer values for cfengine internal use

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Not currently used.

<div class="node">
<p><hr>
<a name="Function-isdir"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-isgreaterthan">Function isgreaterthan</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-irange">Function irange</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.21 Function isdir</h3>

<p class="noindent"><b>Synopsis</b>: isdir(1 args) returns type class

<p class="noindent">True if the named object is a directory

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">

body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
classes:

  "isdir" expression => isdir("/etc");

reports:

  isdir::

    "Directory exists..";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The cfengine process must have access to the object concerned in order for
this to work.

<div class="node">
<p><hr>
<a name="Function-isgreaterthan"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-islessthan">Function islessthan</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-isdir">Function isdir</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.22 Function isgreaterthan</h3>

<p class="noindent"><b>Synopsis</b>: isgreaterthan(2 args) returns type class

<p class="noindent">True if arg1 is numerically greater than arg2, else compare strings like strcmp

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "test"  };
}

###########################################################

bundle agent test

{
classes:

  "ok" expression => isgreaterthan("1","0");

reports:

  ok::

    "Assertion is true";

 !ok::

  "Assertion is false";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The comparison is made numerically if possible. If the values are
strings, the result is identical to that of comparing with &lsquo;<samp><span class="samp">strcmp()</span></samp>&rsquo;.

<div class="node">
<p><hr>
<a name="Function-islessthan"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-islink">Function islink</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-isgreaterthan">Function isgreaterthan</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.23 Function islessthan</h3>

<p class="noindent"><b>Synopsis</b>: islessthan(2 args) returns type class

<p class="noindent">True if arg1 is numerically less than arg2, else compare strings like NOT strcmp

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "test"  };
}

###########################################################

bundle agent test

{
classes:

  "ok" expression => islessthan("0","1");

reports:

  ok::

    "Assertion is true";

 !ok::

  "Assertion is false";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The complement of <code>isgreaterthan</code>. 
The comparison is made numerically if possible. If the values are
strings, the result is identical to that of comparing with &lsquo;<samp><span class="samp">strcmp()</span></samp>&rsquo;.

<div class="node">
<p><hr>
<a name="Function-islink"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-isnewerthan">Function isnewerthan</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-islessthan">Function islessthan</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.24 Function islink</h3>

<p class="noindent"><b>Synopsis</b>: islink(1 args) returns type class

<p class="noindent">True if the named object is a symbolic link

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
classes:

  "isdir" expression => islink("/tmp/link");

reports:

  isdir::

    "Directory exists..";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The link node must both exist and be a symbolic link. Hard links cannot be
detected using this function. A hard link is a regular file or directory.

<div class="node">
<p><hr>
<a name="Function-isnewerthan"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-isplain">Function isplain</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-islink">Function islink</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.25 Function isnewerthan</h3>

<p class="noindent"><b>Synopsis</b>: isnewerthan(2 args) returns type class

<p class="noindent">True if arg1 is newer (modified later) than arg2 (mtime)

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
classes:

  "do_it" and => { isnewerthan("/tmp/later","/tmp/earlier"), "linux" }; 

reports:

  do_it::

    "The derived file needs updating";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This function compares the modification time of the file, referring to changes
of content only.

<div class="node">
<p><hr>
<a name="Function-isplain"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-isvariable">Function isvariable</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-isnewerthan">Function isnewerthan</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.26 Function isplain</h3>

<p class="noindent"><b>Synopsis</b>: isplain(1 args) returns type class

<p class="noindent">True if the named object is a plain/regular file

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
classes:

  "isplain" expression => isplain("/etc/passwd");

reports:

  isplain::

    "File exists..";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="Function-isvariable"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-lastnode">Function lastnode</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-isplain">Function isplain</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.27 Function isvariable</h3>

<p class="noindent"><b>Synopsis</b>: isvariable(1 args) returns type class

<p class="noindent">True if the named variable is defined

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
vars:

  "bla" string => "xyz..";

classes:

  "exists" expression => isvariable("bla");

reports:

  exists::

    "Variable exists: \"$(bla)\"..";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The variable need only exist. This says nothing about its value. Use <code>regcmp</code>
to check variable values.

<div class="node">
<p><hr>
<a name="Function-lastnode"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-ldaparray">Function ldaparray</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-isvariable">Function isvariable</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.28 Function lastnode</h3>

<p class="noindent"><b>Synopsis</b>: lastnode(2 args) returns type string

<p class="noindent">Extract the last of a separated string, e.g. filename from a path

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
bundle agent yes
{
vars:

  "path1" string => "/one/two/last1";
  "path2" string => "one:two:last2";

  "last1" string => lastnode("$(path1)","/");
  "last2" string => lastnode("$(path2)",":");

  "last3" string => lastnode("$(path2)","/");

reports:

  Yr2009::

    "Last = $(last1),$(last2),$(last3)";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This function returns the final node in a chain, given a regular expression to split on. 
This is mainly useful for finding leaf-names of files, from a fully qualified path name.

<div class="node">
<p><hr>
<a name="Function-ldaparray"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-ldaplist">Function ldaplist</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-lastnode">Function lastnode</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.29 Function ldaparray</h3>

<p class="noindent"><b>Synopsis</b>: ldaparray(6 args) returns type class

<p class="noindent">Extract all values from an ldap record

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
classes:

   "gotdata" expression => ldaparray(
                                    "myarray",
                                    "ldap://ldap.example.org",
                                    "dc=cfengine,dc=com",
                                    "(uid=mark)",
                                    "subtree",
                                    "none");

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="example">     
     (class) ldaparray (<var>array</var>,<var>uri</var>,<var>dn</var>,<var>filter</var>,<var>scope</var>,<var>security</var>)
     
</pre>
   </td></tr></table>

   <p>This function retrieves an entire record with all elements and
populates an associative array with the entries. It returns a class
which is true if there was a match for the search and false if nothing
was retrieved.

<p class="noindent"><b>ARGUMENTS</b>:

     <dl>
<dt>&lsquo;<samp><span class="samp">array</span></samp>&rsquo;<dd>String name of the array to populate with the result of the search
<br><dt>&lsquo;<samp><span class="samp">uri</span></samp>&rsquo;<dd>String value of the ldap server. e.g. <code>"ldap://ldap.cfengine.com.no"</code>
<br><dt>&lsquo;<samp><span class="samp">dn</span></samp>&rsquo;<dd>Distinguished name, an ldap formatted name built from components, e.g. "dc=cfengine,dc=com". 
<br><dt>&lsquo;<samp><span class="samp">filter</span></samp>&rsquo;<dd>String filter criterion, in ldap search, e.g. "(sn=User)". 
<br><dt>&lsquo;<samp><span class="samp">scope</span></samp>&rsquo;<dd>Menu option, the type of ldap search, from
     <pre class="smallexample">              subtree
              onelevel
              base
</pre>
     <br><dt>&lsquo;<samp><span class="samp">security</span></samp>&rsquo;<dd>Menu option indicating the encryption and authentication settings
for communication with the LDAP server. These features might be subject
to machine and server capabilites.
     <pre class="smallexample">               none
               ssl
               sasl
</pre>
     </dl>

<div class="node">
<p><hr>
<a name="Function-ldaplist"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-ldapvalue">Function ldapvalue</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-ldaparray">Function ldaparray</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.30 Function ldaplist</h3>

<p class="noindent"><b>Synopsis</b>: ldaplist(6 args) returns type slist

<p class="noindent">Extract all named values from multiple ldap records

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">vars:

   # Get all matching values for "uid" - should be a single record match

  "list" slist =>  ldaplist(
                           "ldap://ldap.example.org",
                           "dc=cfengine,dc=com",
                           "(sn=User)",
                           "uid",
                           "subtree",
                           "none"
                           );

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="example">     
     (slist) ldaplist(<var>uri</var>,<var>dn</var>,<var>filter</var>,<var>name</var>,<var>scope</var>,<var>security</var>)
     
</pre>
   </td></tr></table>

   <p>This function retrieves a single field from all matching LDAP records identified by the search
parameters.

<p class="noindent"><b>ARGUMENTS</b>:

     <dl>
<dt>&lsquo;<samp><span class="samp">uri</span></samp>&rsquo;<dd>String value of the ldap server. e.g. <code>"ldap://ldap.cfengine.com.no"</code>
<br><dt>&lsquo;<samp><span class="samp">dn</span></samp>&rsquo;<dd>Distinguished name, an ldap formatted name built from components, e.g. "dc=cfengine,dc=com". 
<br><dt>&lsquo;<samp><span class="samp">filter</span></samp>&rsquo;<dd>String filter criterion, in ldap search, e.g. "(sn=User)". 
<br><dt>&lsquo;<samp><span class="samp">name</span></samp>&rsquo;<dd>String value, the name of a single record to be retrieved, e.g. <code>uid</code>. 
<br><dt>&lsquo;<samp><span class="samp">scope</span></samp>&rsquo;<dd>Menu option, the type of ldap search, from the specified root. May take values:
     <pre class="smallexample">              subtree
              onelevel
              base
</pre>
     <br><dt>&lsquo;<samp><span class="samp">security</span></samp>&rsquo;<dd>Menu option indicating the encryption and authentication settings
for communication with the LDAP server. These features might be subject
to machine and server capabilites.
     <pre class="smallexample">               none
               ssl
               sasl
</pre>
     </dl>

<div class="node">
<p><hr>
<a name="Function-ldapvalue"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-now">Function now</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-ldaplist">Function ldaplist</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.31 Function ldapvalue</h3>

<p class="noindent"><b>Synopsis</b>: ldapvalue(6 args) returns type string

<p class="noindent">Extract the first matching named value from ldap

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
vars:

   # Get the first matching value for "uid" in schema

  "value" string => ldapvalue(
                             "ldap://ldap.example.org", 
                             "dc=cfengine,dc=com",
                             "(sn=User)",
                             "uid",
                             "subtree",
                             "none"
                             );

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="example">     
     (string) ldapvalue(<var>uri</var>,<var>dn</var>,<var>filter</var>,<var>name</var>,<var>scope</var>,<var>security</var>)
     
</pre>
   </td></tr></table>

   <p>This function retrieves a single field from a single LDAP record identified by the search
parameters. The first matching value it taken.

<p class="noindent"><b>ARGUMENTS</b>:

     <dl>
<dt>&lsquo;<samp><span class="samp">uri</span></samp>&rsquo;<dd>String value of the ldap server. e.g. <code>"ldap://ldap.cfengine.com.no"</code>
<br><dt>&lsquo;<samp><span class="samp">dn</span></samp>&rsquo;<dd>Distinguished name, an ldap formatted name built from components, e.g. "dc=cfengine,dc=com". 
<br><dt>&lsquo;<samp><span class="samp">filter</span></samp>&rsquo;<dd>String filter criterion, in ldap search, e.g. "(sn=User)". 
<br><dt>&lsquo;<samp><span class="samp">name</span></samp>&rsquo;<dd>String value, the name of a single record to be retrieved, e.g. <code>uid</code>. 
<br><dt>&lsquo;<samp><span class="samp">scope</span></samp>&rsquo;<dd>Menu option, the type of ldap search, from the specified root. May take values:
     <pre class="smallexample">              subtree
              onelevel
              base
</pre>
     </dl>

<div class="node">
<p><hr>
<a name="Function-now"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-on">Function on</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-ldapvalue">Function ldapvalue</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.32 Function now</h3>

<p class="noindent"><b>Synopsis</b>: now(0 args) returns type int

<p class="noindent">Convert the current time into system representation

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body file_select zero_age
{
mtime       => irange(ago(1,0,0,0,0,0),now);
file_result => "mtime";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="Function-on"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-peers">Function peers</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-now">Function now</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.33 Function on</h3>

<p class="noindent"><b>Synopsis</b>: on(6 args) returns type int

<p class="noindent">Convert an exact date/time to an integer system representation

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body file_select zero_age
{
mtime       => irange(on(2000,1,1,0,0,0),now);
file_result => "mtime";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>An absolute date. 
Note that in process matching dates could be wrong by an hour
depending on Daylight Savings Time / Summer Time. This is a known bug to be fixed.

<p class="noindent"><b>ARGUMENTS</b>:

     <dl>
<dt>&lsquo;<samp><span class="samp">Years</span></samp>&rsquo;<dd>The year, e.g. 2009
<br><dt>&lsquo;<samp><span class="samp">Month</span></samp>&rsquo;<dd>The Month, 1-12
<br><dt>&lsquo;<samp><span class="samp">Day</span></samp>&rsquo;<dd>The day 1-31
<br><dt>&lsquo;<samp><span class="samp">Hours</span></samp>&rsquo;<dd>The hour 0-23
<br><dt>&lsquo;<samp><span class="samp">Minutes</span></samp>&rsquo;<dd>The minutes
0-59
<br><dt>&lsquo;<samp><span class="samp">Seconds</span></samp>&rsquo;<dd>The number of seconds 0-59
</dl>

<div class="node">
<p><hr>
<a name="Function-peers"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-peerleader">Function peerleader</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-on">Function on</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.34 Function peers</h3>

<p class="noindent"><b>Synopsis</b>: peers(3 args) returns type slist

<p class="noindent">Get a list of peers (not including ourself) from the partition to which we belong

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
bundle agent peers
{
vars:

  "mygroup" slist => peers("/tmp/hostlist","#.*",4);

  "myleader" string => peerleader("/tmp/hostlist","#.*",4);

  "all_leaders" slist => peerleaders("/tmp/hostlist","#.*",4);

reports:

 linux::

   "mypeer $(mygroup)";
   "myleader $(myleader)";
   "another leader $(all_leaders)";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="example">     
     (slist) peers(<var>file of hosts</var>,<var>comment pattern</var>,<var>group size</var>);
     
</pre>
   </td></tr></table>

   <p>This function returns a list of hostnames that may be considered peers
of the current host. Peers are defined according to a list of hosts,
provided as a file in the first argument. This file should contain a
list (one per line), possible with comments, of fully qualified host
names. Cfengine breaks up this list into non-overlapping groups of up to
<var>groupsize</var>, each of which has a leader which is the first host
in the group.

   <p>The current host should belong to this file if it is expected to interact
with the others. The function returns nothing if the host does not belong
to the list.

<p class="noindent"><b>ARGUMENTS</b>:

     <dl>
<dt>&lsquo;<samp><span class="samp">File of hosts</span></samp>&rsquo;<dd>A path to a list of hosts. 
<br><dt>&lsquo;<samp><span class="samp">Comment pattern</span></samp>&rsquo;<dd>A pattern that matches a legal comment in the file
<br><dt>&lsquo;<samp><span class="samp">Group size</span></samp>&rsquo;<dd>A number between 2 and 64 which represents the number of peers in a peer-group. 
An arbitary limit of 64 is set on groups to avoid nonsensical promises. 
</dl>

   <p>Example file:

<pre class="smallexample">     one
     two
     three # this is a comment
     four
     five
     six
     seven
     eight
     nine
     ten
     eleven
     twelve
     etc
     
</pre>
   <div class="node">
<p><hr>
<a name="Function-peerleader"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-peerleaders">Function peerleaders</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-peers">Function peers</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.35 Function peerleader</h3>

<p class="noindent"><b>Synopsis</b>: peerleader(3 args) returns type string

<p class="noindent">Get the assigned peer-leader of the partition to which we belong

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">bundle agent peers
{
vars:

  "mygroup" slist => peers("/tmp/hostlist","#.*",4);

  "myleader" string => peerleader("/tmp/hostlist","#.*",4);

  "all_leaders" slist => peerleaders("/tmp/hostlist","#.*",4);

reports:

 linux::

   "mypeer $(mygroup)";
   "myleader $(myleader)";
   "another leader $(all_leaders)";

}
</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="example">     
     (string) peerleader(<var>file of hosts</var>,<var>comment pattern</var>,<var>group size</var>);
     
</pre>
   </td></tr></table>

   <p>This function returns the name of a ost that may be considered the
leader of a group of peers of the current host. Peers are defined
according to a list of hosts, provided as a file in the first
argument. This file should contain a list (one per line), possible
with comments, of fully qualified host names. Cfengine breaks up this
list into non-overlapping groups of up to <var>groupsize</var>, each of
which has a leader which is the first host in the group.

   <p>The current host should belong to this file if it is expected to interact
with the others. The function returns nothing if the host does not belong
to the list.

<p class="noindent"><b>ARGUMENTS</b>:

     <dl>
<dt>&lsquo;<samp><span class="samp">File of hosts</span></samp>&rsquo;<dd>A path to a list of hosts. 
<br><dt>&lsquo;<samp><span class="samp">Comment pattern</span></samp>&rsquo;<dd>A pattern that matches a legal comment in the file
<br><dt>&lsquo;<samp><span class="samp">Group size</span></samp>&rsquo;<dd>A number between 2 and 64 which represents the number of peers in a peer-group. 
An arbitary limit of 64 is set on groups to avoid nonsensical promises. 
</dl>

   <p>Example file:

<pre class="smallexample">     one
     two
     three # this is a comment
     four
     five
     six
     seven
     eight
     nine
     ten
     eleven
     twelve
     etc
     
</pre>
   <div class="node">
<p><hr>
<a name="Function-peerleaders"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-randomint">Function randomint</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-peerleader">Function peerleader</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.36 Function peerleaders</h3>

<p class="noindent"><b>Synopsis</b>: peerleaders(3 args) returns type slist

<p class="noindent">Get a list of peer leaders from the named partitioning

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">bundle agent peers
{
vars:

  "mygroup" slist => peers("/tmp/hostlist","#.*",4);

  "myleader" string => peerleader("/tmp/hostlist","#.*",4);

  "all_leaders" slist => peerleaders("/tmp/hostlist","#.*",4);

reports:

 linux::

   "mypeer $(mygroup)";
   "myleader $(myleader)";
   "another leader $(all_leaders)";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="example">     
     (slist) peers(<var>file of hosts</var>,<var>comment pattern</var>,<var>group size</var>);
     
</pre>
   </td></tr></table>

   <p>This function returns a list of hostnames that may be considered peer
leaders in the partitioning scheme described in the file of
hosts. Peers are defined according to a list of hosts, provided as a
file in the first argument. This file should contain a list (one per
line), possible with comments, of fully qualified host names. Cfengine
breaks up this list into non-overlapping groups of up to
<var>groupsize</var>, each of which has a leader which is the first host in
the group.

   <p>The current host need not belong to this file.

<p class="noindent"><b>ARGUMENTS</b>:

     <dl>
<dt>&lsquo;<samp><span class="samp">File of hosts</span></samp>&rsquo;<dd>A path to a list of hosts. 
<br><dt>&lsquo;<samp><span class="samp">Comment pattern</span></samp>&rsquo;<dd>A pattern that matches a legal comment in the file
<br><dt>&lsquo;<samp><span class="samp">Group size</span></samp>&rsquo;<dd>A number between 2 and 64 which represents the number of peers in a peer-group. 
An arbitary limit of 64 is set on groups to avoid nonsensical promises. 
</dl>

   <p>Example file:

<pre class="smallexample">     one
     two
     three # this is a comment
     four
     five
     six
     seven
     eight
     nine
     ten
     eleven
     twelve
     etc
     
</pre>
   <div class="node">
<p><hr>
<a name="Function-randomint"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-readfile">Function readfile</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-peerleaders">Function peerleaders</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.37 Function randomint</h3>

<p class="noindent"><b>Synopsis</b>: randomint(2 args) returns type int

<p class="noindent">Generate a random integer between the given limits

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
vars:

 "ran"    int => randomint(4,88);

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The limits must be integer values and the resulting numbers are based
on the entropy of the md5 algorithm.

<div class="node">
<p><hr>
<a name="Function-readfile"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-readintarray">Function readintarray</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-randomint">Function randomint</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.38 Function readfile</h3>

<p class="noindent"><b>Synopsis</b>: readfile(2 args) returns type string

<p class="noindent">Read max number of bytes from named file and assign to variable

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
vars:

 "xxx"   

    string => readfile( "/home/mark/tmp/testfile" , "33" );

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The file (fragment) is read into a single scalar variable.

<div class="node">
<p><hr>
<a name="Function-readintarray"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-readintlist">Function readintlist</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-readfile">Function readfile</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.39 Function readintarray</h3>

<p class="noindent"><b>Synopsis</b>: readintarray(6 args) returns type int

<p class="noindent">Read an array of integers from a file and assign the dimension to a variable

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">vars:

  "dim_array" 

     int =>  readintarray("array_name","/tmp/array","#[^\n]*",":",10,4000);

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Reads a two dimensional array from a file. One dimension is separated by
the character specified in the argument, the other by the the lines in the file. 
The first field of the lines names the first array argument.

<pre class="smallexample">     
     1: 5:7:21:13
     2:19:8:14:14
     3:45:1:78:22
     4:64:2:98:99
</pre>
   <p class="noindent">Results in

<pre class="smallexample">     array_name[1][0]   1
     array_name[1][1]   5
     array_name[1][2]   7
     array_name[1][3]   21
     array_name[1][4]   13
     array_name[2][0]   2
     array_name[2][1]   19
     array_name[2][2]   8
     array_name[2][3]   14
     array_name[2][4]   14
     array_name[3][0]   3
     array_name[3][1]   45
     array_name[3][2]   1
     array_name[3][3]   78
     array_name[3][4]   22
     array_name[4][0]   4
     array_name[4][1]   64
     array_name[4][2]   2
     array_name[4][3]   98
     array_name[4][4]   99
</pre>
   <div class="node">
<p><hr>
<a name="Function-readintlist"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-readrealarray">Function readrealarray</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-readintarray">Function readintarray</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.40 Function readintlist</h3>

<p class="noindent"><b>Synopsis</b>: readintlist(5 args) returns type ilist

<p class="noindent">Read and assign a list variable from a file of separated ints

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">

body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
vars:

  "mylist" ilist => { readintlist("/tmp/listofint","#.*","[\n]",10,400) };

reports:

  Yr2008::

    "List entry: $(mylist)";

}

</pre>

<p class="noindent"><b>ARGUMENTS</b>:

     <dl>
<dt>&lsquo;<samp><span class="samp">filename</span></samp>&rsquo;<dd>The name of a text file containing text to be split up as a list. 
<br><dt>&lsquo;<samp><span class="samp">comment</span></samp>&rsquo;<dd>A regex pattern which is to be ignored in the file
<br><dt>&lsquo;<samp><span class="samp">split</span></samp>&rsquo;<dd>A regex pattern which is to be used to split up the file into items
<br><dt>&lsquo;<samp><span class="samp">maxent</span></samp>&rsquo;<dd>The maximum number of list items to read from the file
<br><dt>&lsquo;<samp><span class="samp">maxsize</span></samp>&rsquo;<dd>The maximum number of bytes to read from the file
</dl>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="Function-readrealarray"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-readreallist">Function readreallist</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-readintlist">Function readintlist</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.41 Function readrealarray</h3>

<p class="noindent"><b>Synopsis</b>: readrealarray(6 args) returns type int

<p class="noindent">Read an array of real numbers from a file and assign the dimension to a variable

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">vars:

  "dim_array" 

     int =>  readrealarray("array_name","/tmp/array","#[^\n]*",":",10,4000);

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>See the notes for <code>readintarray</code>.

<div class="node">
<p><hr>
<a name="Function-readreallist"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-readstringarray">Function readstringarray</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-readrealarray">Function readrealarray</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.42 Function readreallist</h3>

<p class="noindent"><b>Synopsis</b>: readreallist(5 args) returns type rlist

<p class="noindent">Read and assign a list variable from a file of separated real numbers

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">

body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
vars:

  "mylist" ilist => { readreallist("/tmp/listofreal","#.*","[\n]",10,400) };

reports:

  Yr2008::

    "List entry: $(mylist)";

}

</pre>

<p class="noindent"><b>ARGUMENTS</b>:

     <dl>
<dt>&lsquo;<samp><span class="samp">filename</span></samp>&rsquo;<dd>The name of a text file containing text to be split up as a list. 
<br><dt>&lsquo;<samp><span class="samp">comment</span></samp>&rsquo;<dd>A regex pattern which is to be ignored in the file
<br><dt>&lsquo;<samp><span class="samp">split</span></samp>&rsquo;<dd>A regex pattern which is to be used to split up the file into items
<br><dt>&lsquo;<samp><span class="samp">maxent</span></samp>&rsquo;<dd>The maximum number of list items to read from the file
<br><dt>&lsquo;<samp><span class="samp">maxsize</span></samp>&rsquo;<dd>The maximum number of bytes to read from the file
</dl>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="Function-readstringarray"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-readstringlist">Function readstringlist</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-readreallist">Function readreallist</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.43 Function readstringarray</h3>

<p class="noindent"><b>Synopsis</b>: readstringarray(6 args) returns type int

<p class="noindent">Read an array of strings from a file and assign the dimension to a variable

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">vars:

  "dim_array" 

     int =>  readstringarray("array_name","/tmp/array","#[^\n]*",":",10,4000);

</pre>

<p class="noindent">Returns an integer number of keys in the array.

<p class="noindent"><b>ARGUMENTS</b>:

     <dl>
<dt>&lsquo;<samp><span class="samp">array_name</span></samp>&rsquo;<dd>The name to be used for the container array. 
<br><dt>&lsquo;<samp><span class="samp">filename</span></samp>&rsquo;<dd>The name of a text file containing text to be split up as a list. 
<br><dt>&lsquo;<samp><span class="samp">comment</span></samp>&rsquo;<dd>A regex pattern which is to be ignored in the file
<br><dt>&lsquo;<samp><span class="samp">split</span></samp>&rsquo;<dd>A regex pattern which is to be used to split up the file into items
<br><dt>&lsquo;<samp><span class="samp">maxent</span></samp>&rsquo;<dd>The maximum number of list items to read from the file
<br><dt>&lsquo;<samp><span class="samp">maxsize</span></samp>&rsquo;<dd>The maximum number of bytes to read from the file
</dl>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Reads a two dimensional array from a file. One dimension is separated by
the character specified in the argument, the other by the the lines in the file. 
The first field of the lines names the first array argument.

<pre class="smallexample">     
     at:x:25:25:Batch jobs daemon:/var/spool/atjobs:/bin/bash
     avahi:x:103:105:User for Avahi:/var/run/avahi-daemon:/bin/false
     beagleindex:x:104:106:User for Beagle indexing:/var/cache/beagle:/bin/bash
     bin:x:1:1:bin:/bin:/bin/bash
     daemon:x:2:2:Daemon:/sbin:/bin/bash
     
</pre>
   <p class="noindent">Results in a systematically indexed map of the file. Some samples
are show below to illustrate the pattern.

<pre class="smallexample">     ...
     array_name[daemon][0]   daemon
     array_name[daemon][1]   x
     array_name[daemon][2]   2
     array_name[daemon][3]   2
     array_name[daemon][4]   Daemon
     array_name[daemon][5]   /sbin
     array_name[daemon][6]   /bin/bash
     ...
     array_name[at][3]       25
     array_name[at][4]       Batch jobs daemon
     array_name[at][5]       /var/spool/atjobs
     array_name[at][6]       /bin/bash
     ...
     array_name[games][3]    100
     array_name[games][4]    Games account
     array_name[games][5]    /var/games
     array_name[games][6]    /bin/bash
     ...
     
</pre>
   <div class="node">
<p><hr>
<a name="Function-readstringlist"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-readtcp">Function readtcp</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-readstringarray">Function readstringarray</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.44 Function readstringlist</h3>

<p class="noindent"><b>Synopsis</b>: readstringlist(5 args) returns type slist

<p class="noindent">Read and assign a list variable from a file of separated strings

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
vars:

  "mylist" ilist => { readstringlist("/tmp/listofint","#.*","[\n]",10,400) };

reports:

  Yr2008::

    "List entry: $(mylist)";

}

</pre>

<p class="noindent"><b>ARGUMENTS</b>:

     <dl>
<dt>&lsquo;<samp><span class="samp">filename</span></samp>&rsquo;<dd>The name of a text file containing text to be split up as a list. 
<br><dt>&lsquo;<samp><span class="samp">comment</span></samp>&rsquo;<dd>A regex pattern which is to be ignored in the file
<br><dt>&lsquo;<samp><span class="samp">split</span></samp>&rsquo;<dd>A regex pattern which is to be used to split up the file into items
<br><dt>&lsquo;<samp><span class="samp">maxent</span></samp>&rsquo;<dd>The maximum number of list items to read from the file
<br><dt>&lsquo;<samp><span class="samp">maxsize</span></samp>&rsquo;<dd>The maximum number of bytes to read from the file
</dl>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The following example file would be split into a list of the
first ten Green letters.

<pre class="smallexample">     
     alpha
     beta
     gamma # This is a comment
     delta
     epsilon
     zeta
     eta
     theta
     iota
     kappa
     lambda
     mu
     nu
     etc
     
     
</pre>
   <div class="node">
<p><hr>
<a name="Function-readtcp"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-regarray">Function regarray</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-readstringlist">Function readstringlist</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.45 Function readtcp</h3>

<p class="noindent"><b>Synopsis</b>: readtcp(4 args) returns type string

<p class="noindent">Connect to tcp port, send string and assign result to variable

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
bundle agent example

{     
vars:

  "my80" string => readtcp("research.iu.hio.no","80","GET /index.php HTTP/1.1$(const.r)$(const.n)Host: research.iu.hio.no$(const.r)$(const.n)$(const.r)$(const.n)",20);

classes:

  "server_ok" expression => regcmp(".*200 OK.*\n.*","$(my80)");

reports:

  server_ok::

    "Server is alive";

  !server_ok::

    "Server is not responding - got $(my80)";
}

</pre>

     <dl>
<dt>&lsquo;<samp><span class="samp">hostnameip</span></samp>&rsquo;<dd>The host name or IP address of a tcp socket. 
<br><dt>&lsquo;<samp><span class="samp">port</span></samp>&rsquo;<dd>The port number to connect to. 
<br><dt>&lsquo;<samp><span class="samp">sendstring</span></samp>&rsquo;<dd>A string to send to the TCP port to illicit a response
<br><dt>&lsquo;<samp><span class="samp">maxbytes</span></samp>&rsquo;<dd>The maximum number of bytes to read in response. 
</dl>

   <p>Important note: not all Unix TCP read operations respond to signals for interruption so
poorly formed requests can hang. Always test TCP connections fully before deploying. 
When matching multi-line responses, not that regular expressions do not cross newline
boundaries.

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If the send string is empty, no data are sent or received from the socket. Then the
function only tests whether the TCP port is alive and returns an empty variable.

   <p>Note that on some systems the timeout mechanism does not seem to successfully interrupt
the waiting system calls so this might hang if you send a query string that is incorrect. 
This should not happen, but the cause has yet to be diagnosed.

<div class="node">
<p><hr>
<a name="Function-regarray"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-regcmp">Function regcmp</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-readtcp">Function readtcp</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.46 Function regarray</h3>

<p class="noindent"><b>Synopsis</b>: regarray(2 args) returns type class

<p class="noindent">True if arg1 matches any item in the associative array with id=arg2

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "testbundle"  };
}

###########################################

bundle agent testbundle
{
vars:

  "myarray[0]" string => "bla1";
  "myarray[1]" string => "bla2";
  "myarray[3]" string => "bla";
  "myarray"    string => "345";  
  "not"        string => "345";  

classes:

  "ok" expression => regarray("myarray","b.*2");

reports:

 ok::

    "Found in list";

 !ok::

    "Not found in list";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Tests whether an associative array contains elements matching a certain regular expression. 
The result is a class.

<p class="noindent"><b>ARGUMENTS</b>:

     <dl>
<dt>&lsquo;<samp><span class="samp">array_name</span></samp>&rsquo;<dd>The name of the array, with no &lsquo;<samp><span class="samp">$()</span></samp>&rsquo; surrounding, etc. 
<br><dt>&lsquo;<samp><span class="samp">regex</span></samp>&rsquo;<dd>A regular expression to match the content. 
</dl>

<div class="node">
<p><hr>
<a name="Function-regcmp"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-registryvalue">Function registryvalue</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-regarray">Function regarray</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.47 Function regcmp</h3>

<p class="noindent"><b>Synopsis</b>: regcmp(2 args) returns type class

<p class="noindent">True if arg2 is a regular expression matching arg1

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
bundle agent subtest(user)

{
classes:

  "invalid" not => regcmp("[a-z][a-z][a-z][a-z]","$(user)");

reports:

 !invalid::

  "User name $(user) is valid at 4 letters";

 invalid::

  "User name $(user) is invalid";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Compares a string to a regular expression.

<p class="noindent"><b>ARGUMENTS</b>:

     <dl>
<dt>&lsquo;<samp><span class="samp">regex</span></samp>&rsquo;<dd>A regular expression to match the test data. 
<br><dt>&lsquo;<samp><span class="samp">string</span></samp>&rsquo;<dd>Test data for the regular expression. 
</dl>

   <p>If there are multiple-lines in the data, it is necessary to code these explicitely
as regular expressions do not nomally match the end of line as a regular character. 
e.g.

<pre class="smallexample">     
     body common control
     {
     bundlesequence =&gt; { "example" };
     }
     
     bundle agent example
     {
     vars:
     
       "x" string =&gt; "
     NAME: apache2 - Apache 2.2 web server
     CATEGORY: application
     ARCH: all
     VERSION: 2.2.3,REV=2006.09.01
     BASEDIR: /
     VENDOR: http://httpd.apache.org/ packaged for CSW by Cory Omand
     PSTAMP: comand@thor-20060901022929
     INSTDATE: Dec 14 2006 16:05
     HOTLINE: http://www.blastwave.org/bugtrack/
     EMAIL: comand@blastwave.org
     STATUS: completely installed
     ";
     
     classes:
     
     "pkg_installed" expression =&gt; regcmp("(.*\n)*STATUS:\s+completely installed.*\n.*",$(x));
     
     reports:
     
       pkg_installed::
     
         "yes";
     }
     
     
</pre>
   <div class="node">
<p><hr>
<a name="Function-registryvalue"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-regline">Function regline</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-regcmp">Function regcmp</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.48 Function registryvalue</h3>

<p class="noindent"><b>Synopsis</b>: registryvalue(2 args) returns type string

<p class="noindent">Returns a value for an MS-Win registry key,value pair

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
bundle agent reg
{
vars:

  "value" string => registryvalue("HKEY_LOCAL_MACHINE\SOFTWARE\Cfengine AS\Cfengine","value3");

reports:

  WinXP::

   "Value extracted: $(value)";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This function applies only to Windows based systems. it reads a data field for the value named
in the second argument, which lies within the registry key given by the first argument.

<div class="node">
<p><hr>
<a name="Function-regline"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-reglist">Function reglist</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-registryvalue">Function registryvalue</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.49 Function regline</h3>

<p class="noindent"><b>Synopsis</b>: regline(2 args) returns type class

<p class="noindent">True if arg2 is a regular expression matching a line in file arg1

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
bundle agent testbundle

{
files:

  "/tmp/testfile" edit_line => test;
}

########################################################

bundle edit_line test
{
classes:

    "ok" expression => regline(".*XYZ.*","$(edit.filename)");

reports:

 ok::

   "File $(edit.filename) has a line with \"XYZ\" in it";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Note that the regular expression must match an entire line of the
file in order to give a true result. This function is useful for
editfiles applications, where one might want to set a class for
detecting the presence of a string which does not exactly match
one being inserted. e.g.

<pre class="verbatim">
bundle edit_line upgrade_cfexecd
  {
  classes:

    # Check there is not already a crontab line, not identical to
    # the one proposed below...

    "exec_fix" not => regline(".*cf-execd.*","$(edit.filename)");

  insert_lines:

    exec_fix::

     "0,5,10,15,20,25,30,35,40,45,50,55 * * * * /var/cfengine/bin/cf-execd -F";

  reports:

    exec_fix::

     "Added a 5 minute schedule to crontabs";
  }

</pre>

<div class="node">
<p><hr>
<a name="Function-reglist"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-regldap">Function regldap</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-regline">Function regline</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.50 Function reglist</h3>

<p class="noindent"><b>Synopsis</b>: reglist(2 args) returns type class

<p class="noindent">True if arg2 matches any item in the list with id=arg1

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
vars:

 "nameservers" slist => {
                        "128.39.89.10",
                        "128.39.74.16",
                        "192.168.1.103"
                        };
classes:

  "am_name_server" expression => reglist("@(nameservers)","$(sys.ipv4[eth0])");

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Matches a list of test strings to a regular expression.

<p class="noindent"><b>ARGUMENTS</b>:

     <dl>
<dt>&lsquo;<samp><span class="samp">list</span></samp>&rsquo;<dd>The list of strings. 
<br><dt>&lsquo;<samp><span class="samp">regex</span></samp>&rsquo;<dd>The scalar regular expression string. 
</dl>

<div class="node">
<p><hr>
<a name="Function-regldap"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-remotescalar">Function remotescalar</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-reglist">Function reglist</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.51 Function regldap</h3>

<p class="noindent"><b>Synopsis</b>: regldap(7 args) returns type class

<p class="noindent">True if arg6 is a regular expression matching a value item in an ldap search

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
classes:

   "found" expression => regldap(
                                "ldap://ldap.example.org",
                                "dc=cfengine,dc=com",
                                "(sn=User)",
                                "uid",
                                "subtree",
                                "jon.*",
                                "none"
                                );

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="example">     
     (class) regldap(<var>uri</var>,<var>dn</var>,<var>filter</var>,<var>name</var>,<var>scope</var>,<var>regex</var>,<var>security</var>)
     
</pre>
   </td></tr></table>

   <p>This function retrieves a single field from all matching LDAP records identified by the search
parameters and compares it to a regular expression. If there is a match, true is returned
else false.

<p class="noindent"><b>ARGUMENTS</b>:

     <dl>
<dt>&lsquo;<samp><span class="samp">uri</span></samp>&rsquo;<dd>String value of the ldap server. e.g. <code>"ldap://ldap.cfengine.com.no"</code>
<br><dt>&lsquo;<samp><span class="samp">dn</span></samp>&rsquo;<dd>Distinguished name, an ldap formatted name built from components, e.g. "dc=cfengine,dc=com". 
<br><dt>&lsquo;<samp><span class="samp">filter</span></samp>&rsquo;<dd>String filter criterion, in ldap search, e.g. "(sn=User)". 
<br><dt>&lsquo;<samp><span class="samp">name</span></samp>&rsquo;<dd>String value, the name of a single record to be retrieved, e.g. <code>uid</code>. 
<br><dt>&lsquo;<samp><span class="samp">scope</span></samp>&rsquo;<dd>Menu option, the type of ldap search, from the specified root. May take values:
     <pre class="smallexample">              subtree
              onelevel
              base
</pre>
     <br><dt>&lsquo;<samp><span class="samp">regex</span></samp>&rsquo;<dd>A regular expression string to match to the results of an LDAP search. If any
item matches, the result will be true.

     <br><dt>&lsquo;<samp><span class="samp">security</span></samp>&rsquo;<dd>Menu option indicating the encryption and authentication settings
for communication with the LDAP server. These features might be subject
to machine and server capabilites.
     <pre class="smallexample">               none
               ssl
               sasl
</pre>
     </dl>

<div class="node">
<p><hr>
<a name="Function-remotescalar"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-returnszero">Function returnszero</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-regldap">Function regldap</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.52 Function remotescalar</h3>

<p class="noindent"><b>Synopsis</b>: remotescalar(3 args) returns type string

<p class="noindent">Read a scalar value from a remote cfengine server

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
vars:

 "remote" string => remotescalar("test_scalar","127.0.0.1","yes");

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p><table class="cartouche" summary="cartouche" border="1"><tr><td>
<pre class="example">     
     (string) remotescalar(<var>resource handle</var>,<var>host/IP address</var>,<var>encrypt</var>);
     
</pre>
   </td></tr></table>

   <p>This function downloads a string from a remote server, using the promise handle
as a variable identifier. Availability: Enterprise editions of Cfengine only.

<p class="noindent"><b>ARGUMENTS</b>:

     <dl>
<dt>&lsquo;<samp><span class="samp">resource handle</span></samp>&rsquo;<dd>The name of the promise on the server side
<br><dt>&lsquo;<samp><span class="samp">host or IP address</span></samp>&rsquo;<dd>The location of the server on which the resource resides. 
<br><dt>&lsquo;<samp><span class="samp">encrypt</span></samp>&rsquo;<dd>Whether to encrypt the connection to the server.
     <pre class="smallexample">               true
               yes
               false
               no
</pre>
     </dl>

<div class="node">
<p><hr>
<a name="Function-returnszero"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-rrange">Function rrange</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-remotescalar">Function remotescalar</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.53 Function returnszero</h3>

<p class="noindent"><b>Synopsis</b>: returnszero(2 args) returns type class

<p class="noindent">True if named shell command has exit status zero

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
classes:

  "my_result" expression => returnszero("/usr/local/bin/mycommand","noshell");

reports:

  !my_result::

    "Command failed";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This is the complement of <code>execresult</code>, but it returns a class
result rather than the output of the command.

<div class="node">
<p><hr>
<a name="Function-rrange"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-selectservers">Function selectservers</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-returnszero">Function returnszero</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.54 Function rrange</h3>

<p class="noindent"><b>Synopsis</b>: rrange(2 args) returns type rrange [real,real]

<p class="noindent">Define a range of real numbers for cfengine internal use

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
?

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This is not yet used.

<div class="node">
<p><hr>
<a name="Function-selectservers"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-splayclass">Function splayclass</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-rrange">Function rrange</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.55 Function selectservers</h3>

<p class="noindent"><b>Synopsis</b>: selectservers(6 args) returns type int

<p class="noindent">Select tcp servers which respond correctly to a query and return their number, set array of names

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "test"  };
}

###########################################################

bundle agent test

{     
vars:

 "hosts" slist => { "slogans.iu.hio.no", "eternity.iu.hio.no", "nexus.iu.hio.no" };
 
 "up_servers" int =>  selectservers("@(hosts)","80","","","100","alive_servers");

classes:

  "someone_alive" expression => isgreaterthan("$(up_servers)","0");

  "i_am_a_server" expression => regarray("up_servers","$(host)|$(fqhost)");

reports:

  someone_alive::

    "Number of active servers $(up_servers)";
    "First server $(alive_servers[0]) fails over to $(alive_servers[1])";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>This function selects all the TCP ports that are active and
functioning from an ordered list and builds an array of their names. 
This allows us to select a current list of failover alternatives
that are pretested.

     <dl>
<dt>&lsquo;<samp><span class="samp">hostlist</span></samp>&rsquo;<dd>A list of host names or IP addresses to attempt to connect to. 
<br><dt>&lsquo;<samp><span class="samp">port</span></samp>&rsquo;<dd>The port number for the service. 
<br><dt>&lsquo;<samp><span class="samp">sendstr</span></samp>&rsquo;<dd>An optional string to send to the server to illicit a response. 
<br><dt>&lsquo;<samp><span class="samp">regex_on_reply</span></samp>&rsquo;<dd>If a string is sent, this regex must match the resulting reply. 
<br><dt>&lsquo;<samp><span class="samp">maxbytesread_reply</span></samp>&rsquo;<dd>The maximum number of bytes to read as the server's reply. 
<br><dt>&lsquo;<samp><span class="samp">array_name</span></samp>&rsquo;<dd>The name of the array to build containing the names of hosts
that pass the above tests. The array is ordered <code>array_name[0],..</code> etc. 
</dl>

<div class="node">
<p><hr>
<a name="Function-splayclass"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-splitstring">Function splitstring</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-selectservers">Function selectservers</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.56 Function splayclass</h3>

<p class="noindent"><b>Synopsis</b>: splayclass(2 args) returns type class

<p class="noindent">True if the first argument's time-slot has arrived, according to a policy in arg2

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
classes:

  "my_result" expression => splayclass("$(sys.host)$(sys.ipv4)","daily");

reports:

  my_result::

    "Load balanced class activated";

}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>The lvalue class evaluates to true if the system clock lies within a scheduled
time-interval that maps to a hash of the first argument. Different strings will
hash to different time intervals, and thus one can map tasks to time-intervals.

   <p>This function may be used to distribute a task in time over a day or
an hourly period, depending on the policy in the second argument. 
This is useful for copying resources from a single server, e.g. 
software updates when simultaneous scheduling would lead to a bottleneck.

   <p>The function is similar to the splaytime feature in cf-execd, except
that it allows you to base the decision on any string-criterion on a
give host.  The entropy (or string-variation) in the first argument
determines how effectively cfengine will be able to distribute tasks. 
Cfengine instances with the same first argument will yield a true
result at the same time. Thus tasks could be scheduled according to
group names for predictability.

<div class="node">
<p><hr>
<a name="Function-splitstring"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-strcmp">Function strcmp</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-splayclass">Function splayclass</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.57 Function splitstring</h3>

<p class="noindent"><b>Synopsis</b>: splitstring(3 args) returns type slist

<p class="noindent">Convert a string in arg1 into a list of max arg3 strings by splitting on a regular expression in arg2

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
bundle agent test

{
vars:

  "split1" slist => splitstring("one:two:three",":","10");
  "split2" slist => splitstring("alpha:xyz:beta","xyz","10");

reports:

 linux::

  "Found key $(split1)";
  "Found key $(split2)";

}

</pre>

<p class="noindent">Returns a list of strings from a string.

<p class="noindent"><b>ARGUMENTS</b>:

     <dl>
<dt>&lsquo;<samp><span class="samp">string</span></samp>&rsquo;<dd>The string to be split. 
<br><dt>&lsquo;<samp><span class="samp">regex</span></samp>&rsquo;<dd>A regular expression that is to be the delimiter. 
<br><dt>&lsquo;<samp><span class="samp">maxent</span></samp>&rsquo;<dd>The maximum number of list items to be created. 
</dl>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>If the maximum number is insufficient to accomodate all entries, the
final entry will contain the rest of the string.

<div class="node">
<p><hr>
<a name="Function-strcmp"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-usemodule">Function usemodule</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-splitstring">Function splitstring</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.58 Function strcmp</h3>

<p class="noindent"><b>Synopsis</b>: strcmp(2 args) returns type class

<p class="noindent">True if the two strings match exactly

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
classes:

  "same" expression => strcmp("test","test");

reports:

  same::

    "Strings are equal";

 !same::

    "Strings are not equal";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

<div class="node">
<p><hr>
<a name="Function-usemodule"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Function-userexists">Function userexists</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-strcmp">Function strcmp</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.59 Function usemodule</h3>

<p class="noindent"><b>Synopsis</b>: usemodule(2 args) returns type class

<p class="noindent">Execute cfengine module script and set class if successful

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">
body common control
   {
   any::

      bundlesequence  => {
                         test
                         };
   }

###################################################################

bundle agent test

{
classes:

  # returns $(user)

  "done" expression => usemodule("getusers","");

commands:

  "/bin/echo promiser text" args => "test $(user)";
}

</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Modules must reside in <samp><span class="file">WORKDIR/modules</span></samp> but no longer require
a special naming convention.

<p class="noindent"><b>ARGUMENTS</b>:

     <dl>
<dt>&lsquo;<samp><span class="samp">Module name</span></samp>&rsquo;<dd>The name of the module without its leading path, since it is assuemed
to be in the registered modules directory.

     <br><dt>&lsquo;<samp><span class="samp">Argument string</span></samp>&rsquo;<dd>Any command link arguments to pass to the module.

   </dl>

<div class="node">
<p><hr>
<a name="Function-userexists"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Function-usemodule">Function usemodule</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-functions">Special functions</a>

</div>

<h3 class="section">11.60 Function userexists</h3>

<p class="noindent"><b>Synopsis</b>: userexists(1 args) returns type class

<p class="noindent">True if user name or numerical id exists on this host

<p class="noindent"><b>Example</b>:<br>
<br>

<pre class="verbatim">

body common control

{
bundlesequence  => { "example" };
}

###########################################################

bundle agent example

{     
classes:

  "ok" expression => userexists("root");

reports:

  ok::

    "Root exists";

 !ok::

    "Root does not exist";
}


</pre>

<p class="noindent"><b>Notes</b>:<br>
<br>

   <p>Checks whether the user is in the password database for the current host. 
The argument must be a user name or user id.

<!-- ***************************************************** -->
<!-- * CHAPTER -->
<!-- ***************************************************** -->
<div class="node">
<p><hr>
<a name="Special-Variables"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Logs-and-records">Logs and records</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Special-functions">Special functions</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Top">Top</a>

</div>

<h2 class="chapter">12 Special Variables</h2>

<ul class="menu">
<li><a accesskey="1" href="#Variable-context-const">Variable context const</a>
<li><a accesskey="2" href="#Variable-context-sys">Variable context sys</a>
<li><a accesskey="3" href="#Variable-context-mon">Variable context mon</a>
</ul>

<div class="node">
<p><hr>
<a name="Variable-context-const"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-context-sys">Variable context sys</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Special-Variables">Special Variables</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-Variables">Special Variables</a>

</div>

<h3 class="section">12.1 Variable context <code>const</code></h3>

<p><br>

   <p>Cfengine defines a number of variables for embedding unprintable values
or values with special meanings in strings.

<ul class="menu">
<li><a accesskey="1" href="#Variable-const_002edollar">Variable const.dollar</a>
<li><a accesskey="2" href="#Variable-const_002eendl">Variable const.endl</a>
<li><a accesskey="3" href="#Variable-const_002en">Variable const.n</a>
<li><a accesskey="4" href="#Variable-const_002er">Variable const.r</a>
</ul>

<div class="node">
<p><hr>
<a name="Variable-const.dollar"></a>
<a name="Variable-const_002edollar"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-const_002eendl">Variable const.endl</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-context-const">Variable context const</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-const">Variable context const</a>

</div>

<h4 class="subsection">12.1.1 Variable const.dollar</h4>

<p><br>

<pre class="verbatim">
reports:

  some::

   "The value of $(const.dollar)(const.dollar) is $(const.dollar)";

   "But the value of \$(dollar) is \$(dollar)";

</pre>

<div class="node">
<p><hr>
<a name="Variable-const.endl"></a>
<a name="Variable-const_002eendl"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-const_002en">Variable const.n</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-const_002edollar">Variable const.dollar</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-const">Variable context const</a>

</div>

<h4 class="subsection">12.1.2 Variable const.endl</h4>

<p><br>

<pre class="verbatim">
reports:

  "A newline with either $(const.endl) or with $(const.n) is ok";

</pre>

<div class="node">
<p><hr>
<a name="Variable-const.n"></a>
<a name="Variable-const_002en"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-const_002er">Variable const.r</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-const_002eendl">Variable const.endl</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-const">Variable context const</a>

</div>

<h4 class="subsection">12.1.3 Variable const.n</h4>

<p><br>

<pre class="verbatim">
reports:

  "A newline with either $(const.n) or with $(const.endl) is ok";

</pre>

<div class="node">
<p><hr>
<a name="Variable-const.r"></a>
<a name="Variable-const_002er"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-const_002en">Variable const.n</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-const">Variable context const</a>

</div>

<h4 class="subsection">12.1.4 Variable const.r</h4>

<p><br>

<pre class="verbatim">
reports:

  "A carriage return character is $(const.r)";

</pre>

<div class="node">
<p><hr>
<a name="Variable-context-sys"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-context-mon">Variable context mon</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-context-const">Variable context const</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-Variables">Special Variables</a>

</div>

<h3 class="section">12.2 Variable context <code>sys</code></h3>

<p><br>

   <p>System variables are derived from cfengine's automated discovery of system values. 
They are provided as variables in order to make automatically adaptive rules for
configuration, e.g.

<pre class="verbatim">
files:

 any::

  "$(sys.resolv)"

      create        => "true",
      edit_line     => doresolv("@(this.list1)","@(this.list2)"),
      edit_defaults => reconstruct;

</pre>

<p class="noindent">The above rule requires no class specification because the
variable itself is class-specific.

<ul class="menu">
<li><a accesskey="1" href="#Variable-sys_002earch">Variable sys.arch</a>
<li><a accesskey="2" href="#Variable-sys_002ecdate">Variable sys.cdate</a>
<li><a accesskey="3" href="#Variable-sys_002eclass">Variable sys.class</a>
<li><a accesskey="4" href="#Variable-sys_002edate">Variable sys.date</a>
<li><a accesskey="5" href="#Variable-sys_002edomain">Variable sys.domain</a>
<li><a accesskey="6" href="#Variable-sys_002efqhost">Variable sys.fqhost</a>
<li><a accesskey="7" href="#Variable-sys_002efstab">Variable sys.fstab</a>
<li><a accesskey="8" href="#Variable-sys_002ehost">Variable sys.host</a>
<li><a accesskey="9" href="#Variable-sys_002elong_005farch">Variable sys.long_arch</a>
<li><a href="#Variable-sys_002emaildir">Variable sys.maildir</a>
<li><a href="#Variable-sys_002eos">Variable sys.os</a>
<li><a href="#Variable-sys_002eostype">Variable sys.ostype</a>
<li><a href="#Variable-sys_002erelease">Variable sys.release</a>
<li><a href="#Variable-sys_002eresolv">Variable sys.resolv</a>
<li><a href="#Variable-sys_002euqhost">Variable sys.uqhost</a>
<li><a href="#Variable-sys_002eworkdir">Variable sys.workdir</a>
</ul>

<div class="node">
<p><hr>
<a name="Variable-sys.arch"></a>
<a name="Variable-sys_002earch"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-sys_002ecdate">Variable sys.cdate</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-context-sys">Variable context sys</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-sys">Variable context sys</a>

</div>

<h4 class="subsection">12.2.1 Variable sys.arch</h4>

<p><br>

   <p>The variable gives the kernel's short architecture description.

<pre class="verbatim">
# arch = x86_64

</pre>

<div class="node">
<p><hr>
<a name="Variable-sys.cdate"></a>
<a name="Variable-sys_002ecdate"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-sys_002eclass">Variable sys.class</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-sys_002earch">Variable sys.arch</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-sys">Variable context sys</a>

</div>

<h4 class="subsection">12.2.2 Variable sys.cdate</h4>

<p><br>

   <p>The date of the system in canonical form, i.e. in the form of a class.

<pre class="verbatim">
# cdate = Sun_Dec__7_10_39_53_2008_

</pre>

<div class="node">
<p><hr>
<a name="Variable-sys.class"></a>
<a name="Variable-sys_002eclass"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-sys_002edate">Variable sys.date</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-sys_002ecdate">Variable sys.cdate</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-sys">Variable context sys</a>

</div>

<h4 class="subsection">12.2.3 Variable sys.class</h4>

<p><br>

   <p>This variable contains the name of the hard-class category for this host, i.e. its
top level operating system type classification.

<pre class="verbatim">
# class = linux

</pre>

<div class="node">
<p><hr>
<a name="Variable-sys.date"></a>
<a name="Variable-sys_002edate"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-sys_002edomain">Variable sys.domain</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-sys_002eclass">Variable sys.class</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-sys">Variable context sys</a>

</div>

<h4 class="subsection">12.2.4 Variable sys.date</h4>

<p><br>

   <p>The date of the system as a text string.

<pre class="verbatim">
# date = Sun Dec  7 10:39:53 2008

</pre>

<div class="node">
<p><hr>
<a name="Variable-sys.domain"></a>
<a name="Variable-sys_002edomain"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-sys_002efqhost">Variable sys.fqhost</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-sys_002edate">Variable sys.date</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-sys">Variable context sys</a>

</div>

<h4 class="subsection">12.2.5 Variable sys.domain</h4>

<p><br>

   <p>The domain name as divined by cfengine. If the DNS is in use, it could
be possible to derive the domain name from its DNS regisration, but in
general there is no way to discover this value automatically. The
<code>common control</code> body permits the ultimate specification of this
value.

<pre class="verbatim">
# domain = example.org
 
</pre>

<div class="node">
<p><hr>
<a name="Variable-sys.fqhost"></a>
<a name="Variable-sys_002efqhost"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-sys_002efstab">Variable sys.fstab</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-sys_002edomain">Variable sys.domain</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-sys">Variable context sys</a>

</div>

<h4 class="subsection">12.2.6 Variable sys.fqhost</h4>

<p><br>

   <p>The fully qualified name of the host. In order to compute this value properly, the domain
name must be defined.

<pre class="verbatim">
# fqhost = host.example.org

</pre>

<div class="node">
<p><hr>
<a name="Variable-sys.fstab"></a>
<a name="Variable-sys_002efstab"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-sys_002ehost">Variable sys.host</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-sys_002efqhost">Variable sys.fqhost</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-sys">Variable context sys</a>

</div>

<h4 class="subsection">12.2.7 Variable sys.fstab</h4>

<p><br>

   <p>The location of the system filesystem (mount) table.

<pre class="verbatim">
# fstab = /etc/fstab

</pre>

<div class="node">
<p><hr>
<a name="Variable-sys.host"></a>
<a name="Variable-sys_002ehost"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-sys_002elong_005farch">Variable sys.long_arch</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-sys_002efstab">Variable sys.fstab</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-sys">Variable context sys</a>

</div>

<h4 class="subsection">12.2.8 Variable sys.host</h4>

<p><br>

   <p>The name of the current host, according to the kernel. It is undefined whether this
is qualified or unqualified with a domain name.

<pre class="verbatim">
# host = myhost

</pre>

<div class="node">
<p><hr>
<a name="Variable-sys.long_arch"></a>
<a name="Variable-sys_002elong_005farch"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-sys_002emaildir">Variable sys.maildir</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-sys_002ehost">Variable sys.host</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-sys">Variable context sys</a>

</div>

<h4 class="subsection">12.2.9 Variable sys.long_arch</h4>

<p><br>

   <p>The long architecture name for this system kernel. This name is sometimes quite unwieldy
but can be useful for logging purposes.

<pre class="verbatim">
# long_arch = linux_x86_64_2_6_22_19_0_1_default__1_SMP_2008_10_14_22_17_43__0200

</pre>

<div class="node">
<p><hr>
<a name="Variable-sys.maildir"></a>
<a name="Variable-sys_002emaildir"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-sys_002eos">Variable sys.os</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-sys_002elong_005farch">Variable sys.long_arch</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-sys">Variable context sys</a>

</div>

<h4 class="subsection">12.2.10 Variable sys.maildir</h4>

<p><br>

   <p>The name of the system email spool directory.

<pre class="verbatim">
# maildir = /var/spool/mail

</pre>

<div class="node">
<p><hr>
<a name="Variable-sys.os"></a>
<a name="Variable-sys_002eos"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-sys_002eostype">Variable sys.ostype</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-sys_002emaildir">Variable sys.maildir</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-sys">Variable context sys</a>

</div>

<h4 class="subsection">12.2.11 Variable sys.os</h4>

<p><br>

   <p>The name of the operating system according to the kernel.

<pre class="verbatim">
# os = linux

</pre>

<div class="node">
<p><hr>
<a name="Variable-sys.ostype"></a>
<a name="Variable-sys_002eostype"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-sys_002erelease">Variable sys.release</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-sys_002eos">Variable sys.os</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-sys">Variable context sys</a>

</div>

<h4 class="subsection">12.2.12 Variable sys.ostype</h4>

<p><br>

   <p>Another name for the operating system.

<pre class="verbatim">
# ostype = linux_x86_64

</pre>

<div class="node">
<p><hr>
<a name="Variable-sys.release"></a>
<a name="Variable-sys_002erelease"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-sys_002eresolv">Variable sys.resolv</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-sys_002eostype">Variable sys.ostype</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-sys">Variable context sys</a>

</div>

<h4 class="subsection">12.2.13 Variable sys.release</h4>

<p><br>

   <p>The kernel release of the operating system.

<pre class="verbatim">
# release = 2.6.22.19-0.1-default

</pre>

<div class="node">
<p><hr>
<a name="Variable-sys.resolv"></a>
<a name="Variable-sys_002eresolv"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-sys_002euqhost">Variable sys.uqhost</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-sys_002erelease">Variable sys.release</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-sys">Variable context sys</a>

</div>

<h4 class="subsection">12.2.14 Variable sys.resolv</h4>

<p><br>

   <p>The location of the system resolver file.

<pre class="verbatim">
# resolv = /etc/resolv.conf

</pre>

<div class="node">
<p><hr>
<a name="Variable-sys.uqhost"></a>
<a name="Variable-sys_002euqhost"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-sys_002eworkdir">Variable sys.workdir</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-sys_002eresolv">Variable sys.resolv</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-sys">Variable context sys</a>

</div>

<h4 class="subsection">12.2.15 Variable sys.uqhost</h4>

<p><br>

   <p>The unqualified name of the current host. See also <code>sys.fqhost</code>.

<pre class="verbatim">
# uqhost = myhost

</pre>

<div class="node">
<p><hr>
<a name="Variable-sys.workdir"></a>
<a name="Variable-sys_002eworkdir"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-sys_002euqhost">Variable sys.uqhost</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-sys">Variable context sys</a>

</div>

<h4 class="subsection">12.2.16 Variable sys.workdir</h4>

<p><br>

   <p>The location of the cfengine work directory and cache. For the
system privileged user this is normally:

<pre class="verbatim">
# workdir = /var/cfengine

</pre>

   <p>For non-privileged users it is in the user's home directory:

<pre class="verbatim">
# workdir = /home/user/.cfagent

</pre>

<div class="node">
<p><hr>
<a name="Variable-context-mon"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-context-sys">Variable context sys</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Special-Variables">Special Variables</a>

</div>

<h3 class="section">12.3 Variable context <code>mon</code></h3>

<p><br>

   <p>The variables discovered by <code>cf-monitord</code> are placed in this monitoring
context. Monitoring variables are expected to be ephemeral properties, rapidly changing.

   <p>In enterprise versions of cfengine, custom defined monitoring targets also become
variables in this context, named by the handle of the promise that defined them.

<ul class="menu">
<li><a accesskey="1" href="#Variable-mon_002evalue_005fusers">Variable mon.value_users</a>
<li><a accesskey="2" href="#Variable-mon_002eaverage_005fusers">Variable mon.average_users</a>
<li><a accesskey="3" href="#Variable-mon_002estddev_005fusers">Variable mon.stddev_users</a>
<li><a accesskey="4" href="#Variable-mon_002evalue_005frootprocs">Variable mon.value_rootprocs</a>
<li><a accesskey="5" href="#Variable-mon_002eaverage_005frootprocs">Variable mon.average_rootprocs</a>
<li><a accesskey="6" href="#Variable-mon_002estddev_005frootprocs">Variable mon.stddev_rootprocs</a>
<li><a accesskey="7" href="#Variable-mon_002evalue_005fotherprocs">Variable mon.value_otherprocs</a>
<li><a accesskey="8" href="#Variable-mon_002eaverage_005fotherprocs">Variable mon.average_otherprocs</a>
<li><a accesskey="9" href="#Variable-mon_002estddev_005fotherprocs">Variable mon.stddev_otherprocs</a>
<li><a href="#Variable-mon_002evalue_005fdiskfree">Variable mon.value_diskfree</a>
<li><a href="#Variable-mon_002eaverage_005fdiskfree">Variable mon.average_diskfree</a>
<li><a href="#Variable-mon_002estddev_005fdiskfree">Variable mon.stddev_diskfree</a>
<li><a href="#Variable-mon_002evalue_005floadavg">Variable mon.value_loadavg</a>
<li><a href="#Variable-mon_002eaverage_005floadavg">Variable mon.average_loadavg</a>
<li><a href="#Variable-mon_002estddev_005floadavg">Variable mon.stddev_loadavg</a>
<li><a href="#Variable-mon_002evalue_005fnetbiosns_005fin">Variable mon.value_netbiosns_in</a>
<li><a href="#Variable-mon_002eaverage_005fnetbiosns_005fin">Variable mon.average_netbiosns_in</a>
<li><a href="#Variable-mon_002estddev_005fnetbiosns_005fin">Variable mon.stddev_netbiosns_in</a>
<li><a href="#Variable-mon_002evalue_005fnetbiosns_005fout">Variable mon.value_netbiosns_out</a>
<li><a href="#Variable-mon_002eaverage_005fnetbiosns_005fout">Variable mon.average_netbiosns_out</a>
<li><a href="#Variable-mon_002estddev_005fnetbiosns_005fout">Variable mon.stddev_netbiosns_out</a>
<li><a href="#Variable-mon_002evalue_005fnetbiosdgm_005fin">Variable mon.value_netbiosdgm_in</a>
<li><a href="#Variable-mon_002eaverage_005fnetbiosdgm_005fin">Variable mon.average_netbiosdgm_in</a>
<li><a href="#Variable-mon_002estddev_005fnetbiosdgm_005fin">Variable mon.stddev_netbiosdgm_in</a>
<li><a href="#Variable-mon_002evalue_005fnetbiosdgm_005fout">Variable mon.value_netbiosdgm_out</a>
<li><a href="#Variable-mon_002eaverage_005fnetbiosdgm_005fout">Variable mon.average_netbiosdgm_out</a>
<li><a href="#Variable-mon_002estddev_005fnetbiosdgm_005fout">Variable mon.stddev_netbiosdgm_out</a>
<li><a href="#Variable-mon_002evalue_005fnetbiosssn_005fin">Variable mon.value_netbiosssn_in</a>
<li><a href="#Variable-mon_002eaverage_005fnetbiosssn_005fin">Variable mon.average_netbiosssn_in</a>
<li><a href="#Variable-mon_002estddev_005fnetbiosssn_005fin">Variable mon.stddev_netbiosssn_in</a>
<li><a href="#Variable-mon_002evalue_005fnetbiosssn_005fout">Variable mon.value_netbiosssn_out</a>
<li><a href="#Variable-mon_002eaverage_005fnetbiosssn_005fout">Variable mon.average_netbiosssn_out</a>
<li><a href="#Variable-mon_002estddev_005fnetbiosssn_005fout">Variable mon.stddev_netbiosssn_out</a>
<li><a href="#Variable-mon_002evalue_005firc_005fin">Variable mon.value_irc_in</a>
<li><a href="#Variable-mon_002eaverage_005firc_005fin">Variable mon.average_irc_in</a>
<li><a href="#Variable-mon_002estddev_005firc_005fin">Variable mon.stddev_irc_in</a>
<li><a href="#Variable-mon_002evalue_005firc_005fout">Variable mon.value_irc_out</a>
<li><a href="#Variable-mon_002eaverage_005firc_005fout">Variable mon.average_irc_out</a>
<li><a href="#Variable-mon_002estddev_005firc_005fout">Variable mon.stddev_irc_out</a>
<li><a href="#Variable-mon_002evalue_005fcfengine_005fin">Variable mon.value_cfengine_in</a>
<li><a href="#Variable-mon_002eaverage_005fcfengine_005fin">Variable mon.average_cfengine_in</a>
<li><a href="#Variable-mon_002estddev_005fcfengine_005fin">Variable mon.stddev_cfengine_in</a>
<li><a href="#Variable-mon_002evalue_005fcfengine_005fout">Variable mon.value_cfengine_out</a>
<li><a href="#Variable-mon_002eaverage_005fcfengine_005fout">Variable mon.average_cfengine_out</a>
<li><a href="#Variable-mon_002estddev_005fcfengine_005fout">Variable mon.stddev_cfengine_out</a>
<li><a href="#Variable-mon_002evalue_005fnfsd_005fin">Variable mon.value_nfsd_in</a>
<li><a href="#Variable-mon_002eaverage_005fnfsd_005fin">Variable mon.average_nfsd_in</a>
<li><a href="#Variable-mon_002estddev_005fnfsd_005fin">Variable mon.stddev_nfsd_in</a>
<li><a href="#Variable-mon_002evalue_005fnfsd_005fout">Variable mon.value_nfsd_out</a>
<li><a href="#Variable-mon_002eaverage_005fnfsd_005fout">Variable mon.average_nfsd_out</a>
<li><a href="#Variable-mon_002estddev_005fnfsd_005fout">Variable mon.stddev_nfsd_out</a>
<li><a href="#Variable-mon_002evalue_005fsmtp_005fin">Variable mon.value_smtp_in</a>
<li><a href="#Variable-mon_002eaverage_005fsmtp_005fin">Variable mon.average_smtp_in</a>
<li><a href="#Variable-mon_002estddev_005fsmtp_005fin">Variable mon.stddev_smtp_in</a>
<li><a href="#Variable-mon_002evalue_005fsmtp_005fout">Variable mon.value_smtp_out</a>
<li><a href="#Variable-mon_002eaverage_005fsmtp_005fout">Variable mon.average_smtp_out</a>
<li><a href="#Variable-mon_002estddev_005fsmtp_005fout">Variable mon.stddev_smtp_out</a>
<li><a href="#Variable-mon_002evalue_005fwww_005fin">Variable mon.value_www_in</a>
<li><a href="#Variable-mon_002eaverage_005fwww_005fin">Variable mon.average_www_in</a>
<li><a href="#Variable-mon_002estddev_005fwww_005fin">Variable mon.stddev_www_in</a>
<li><a href="#Variable-mon_002evalue_005fwww_005fout">Variable mon.value_www_out</a>
<li><a href="#Variable-mon_002eaverage_005fwww_005fout">Variable mon.average_www_out</a>
<li><a href="#Variable-mon_002estddev_005fwww_005fout">Variable mon.stddev_www_out</a>
<li><a href="#Variable-mon_002evalue_005fftp_005fin">Variable mon.value_ftp_in</a>
<li><a href="#Variable-mon_002eaverage_005fftp_005fin">Variable mon.average_ftp_in</a>
<li><a href="#Variable-mon_002estddev_005fftp_005fin">Variable mon.stddev_ftp_in</a>
<li><a href="#Variable-mon_002evalue_005fftp_005fout">Variable mon.value_ftp_out</a>
<li><a href="#Variable-mon_002eaverage_005fftp_005fout">Variable mon.average_ftp_out</a>
<li><a href="#Variable-mon_002estddev_005fftp_005fout">Variable mon.stddev_ftp_out</a>
<li><a href="#Variable-mon_002evalue_005fssh_005fin">Variable mon.value_ssh_in</a>
<li><a href="#Variable-mon_002eaverage_005fssh_005fin">Variable mon.average_ssh_in</a>
<li><a href="#Variable-mon_002estddev_005fssh_005fin">Variable mon.stddev_ssh_in</a>
<li><a href="#Variable-mon_002evalue_005fssh_005fout">Variable mon.value_ssh_out</a>
<li><a href="#Variable-mon_002eaverage_005fssh_005fout">Variable mon.average_ssh_out</a>
<li><a href="#Variable-mon_002estddev_005fssh_005fout">Variable mon.stddev_ssh_out</a>
<li><a href="#Variable-mon_002evalue_005fwwws_005fin">Variable mon.value_wwws_in</a>
<li><a href="#Variable-mon_002eaverage_005fwwws_005fin">Variable mon.average_wwws_in</a>
<li><a href="#Variable-mon_002estddev_005fwwws_005fin">Variable mon.stddev_wwws_in</a>
<li><a href="#Variable-mon_002evalue_005fwwws_005fout">Variable mon.value_wwws_out</a>
<li><a href="#Variable-mon_002eaverage_005fwwws_005fout">Variable mon.average_wwws_out</a>
<li><a href="#Variable-mon_002estddev_005fwwws_005fout">Variable mon.stddev_wwws_out</a>
<li><a href="#Variable-mon_002evalue_005ficmp_005fin">Variable mon.value_icmp_in</a>
<li><a href="#Variable-mon_002eaverage_005ficmp_005fin">Variable mon.average_icmp_in</a>
<li><a href="#Variable-mon_002estddev_005ficmp_005fin">Variable mon.stddev_icmp_in</a>
<li><a href="#Variable-mon_002evalue_005ficmp_005fout">Variable mon.value_icmp_out</a>
<li><a href="#Variable-mon_002eaverage_005ficmp_005fout">Variable mon.average_icmp_out</a>
<li><a href="#Variable-mon_002estddev_005ficmp_005fout">Variable mon.stddev_icmp_out</a>
<li><a href="#Variable-mon_002evalue_005fudp_005fin">Variable mon.value_udp_in</a>
<li><a href="#Variable-mon_002eaverage_005fudp_005fin">Variable mon.average_udp_in</a>
<li><a href="#Variable-mon_002estddev_005fudp_005fin">Variable mon.stddev_udp_in</a>
<li><a href="#Variable-mon_002evalue_005fudp_005fout">Variable mon.value_udp_out</a>
<li><a href="#Variable-mon_002eaverage_005fudp_005fout">Variable mon.average_udp_out</a>
<li><a href="#Variable-mon_002estddev_005fudp_005fout">Variable mon.stddev_udp_out</a>
<li><a href="#Variable-mon_002evalue_005fdns_005fin">Variable mon.value_dns_in</a>
<li><a href="#Variable-mon_002eaverage_005fdns_005fin">Variable mon.average_dns_in</a>
<li><a href="#Variable-mon_002estddev_005fdns_005fin">Variable mon.stddev_dns_in</a>
<li><a href="#Variable-mon_002evalue_005fdns_005fout">Variable mon.value_dns_out</a>
<li><a href="#Variable-mon_002eaverage_005fdns_005fout">Variable mon.average_dns_out</a>
<li><a href="#Variable-mon_002estddev_005fdns_005fout">Variable mon.stddev_dns_out</a>
<li><a href="#Variable-mon_002evalue_005ftcpsyn_005fin">Variable mon.value_tcpsyn_in</a>
<li><a href="#Variable-mon_002eaverage_005ftcpsyn_005fin">Variable mon.average_tcpsyn_in</a>
<li><a href="#Variable-mon_002estddev_005ftcpsyn_005fin">Variable mon.stddev_tcpsyn_in</a>
<li><a href="#Variable-mon_002evalue_005ftcpsyn_005fout">Variable mon.value_tcpsyn_out</a>
<li><a href="#Variable-mon_002eaverage_005ftcpsyn_005fout">Variable mon.average_tcpsyn_out</a>
<li><a href="#Variable-mon_002estddev_005ftcpsyn_005fout">Variable mon.stddev_tcpsyn_out</a>
<li><a href="#Variable-mon_002evalue_005ftcpack_005fin">Variable mon.value_tcpack_in</a>
<li><a href="#Variable-mon_002eaverage_005ftcpack_005fin">Variable mon.average_tcpack_in</a>
<li><a href="#Variable-mon_002estddev_005ftcpack_005fin">Variable mon.stddev_tcpack_in</a>
<li><a href="#Variable-mon_002evalue_005ftcpack_005fout">Variable mon.value_tcpack_out</a>
<li><a href="#Variable-mon_002eaverage_005ftcpack_005fout">Variable mon.average_tcpack_out</a>
<li><a href="#Variable-mon_002estddev_005ftcpack_005fout">Variable mon.stddev_tcpack_out</a>
<li><a href="#Variable-mon_002evalue_005ftcpfin_005fin">Variable mon.value_tcpfin_in</a>
<li><a href="#Variable-mon_002eaverage_005ftcpfin_005fin">Variable mon.average_tcpfin_in</a>
<li><a href="#Variable-mon_002estddev_005ftcpfin_005fin">Variable mon.stddev_tcpfin_in</a>
<li><a href="#Variable-mon_002evalue_005ftcpfin_005fout">Variable mon.value_tcpfin_out</a>
<li><a href="#Variable-mon_002eaverage_005ftcpfin_005fout">Variable mon.average_tcpfin_out</a>
<li><a href="#Variable-mon_002estddev_005ftcpfin_005fout">Variable mon.stddev_tcpfin_out</a>
<li><a href="#Variable-mon_002evalue_005ftcpmisc_005fin">Variable mon.value_tcpmisc_in</a>
<li><a href="#Variable-mon_002eaverage_005ftcpmisc_005fin">Variable mon.average_tcpmisc_in</a>
<li><a href="#Variable-mon_002estddev_005ftcpmisc_005fin">Variable mon.stddev_tcpmisc_in</a>
<li><a href="#Variable-mon_002evalue_005ftcpmisc_005fout">Variable mon.value_tcpmisc_out</a>
<li><a href="#Variable-mon_002eaverage_005ftcpmisc_005fout">Variable mon.average_tcpmisc_out</a>
<li><a href="#Variable-mon_002estddev_005ftcpmisc_005fout">Variable mon.stddev_tcpmisc_out</a>
<li><a href="#Variable-mon_002evalue_005fwebaccess">Variable mon.value_webaccess</a>
<li><a href="#Variable-mon_002eaverage_005fwebaccess">Variable mon.average_webaccess</a>
<li><a href="#Variable-mon_002estddev_005fwebaccess">Variable mon.stddev_webaccess</a>
<li><a href="#Variable-mon_002evalue_005fweberrors">Variable mon.value_weberrors</a>
<li><a href="#Variable-mon_002eaverage_005fweberrors">Variable mon.average_weberrors</a>
<li><a href="#Variable-mon_002estddev_005fweberrors">Variable mon.stddev_weberrors</a>
<li><a href="#Variable-mon_002evalue_005fsyslog">Variable mon.value_syslog</a>
<li><a href="#Variable-mon_002eaverage_005fsyslog">Variable mon.average_syslog</a>
<li><a href="#Variable-mon_002estddev_005fsyslog">Variable mon.stddev_syslog</a>
<li><a href="#Variable-mon_002evalue_005fmessages">Variable mon.value_messages</a>
<li><a href="#Variable-mon_002eaverage_005fmessages">Variable mon.average_messages</a>
<li><a href="#Variable-mon_002estddev_005fmessages">Variable mon.stddev_messages</a>
<li><a href="#Variable-mon_002evalue_005ftemp0">Variable mon.value_temp0</a>
<li><a href="#Variable-mon_002eaverage_005ftemp0">Variable mon.average_temp0</a>
<li><a href="#Variable-mon_002estddev_005ftemp0">Variable mon.stddev_temp0</a>
<li><a href="#Variable-mon_002evalue_005ftemp1">Variable mon.value_temp1</a>
<li><a href="#Variable-mon_002eaverage_005ftemp1">Variable mon.average_temp1</a>
<li><a href="#Variable-mon_002estddev_005ftemp1">Variable mon.stddev_temp1</a>
<li><a href="#Variable-mon_002evalue_005ftemp2">Variable mon.value_temp2</a>
<li><a href="#Variable-mon_002eaverage_005ftemp2">Variable mon.average_temp2</a>
<li><a href="#Variable-mon_002estddev_005ftemp2">Variable mon.stddev_temp2</a>
<li><a href="#Variable-mon_002evalue_005ftemp3">Variable mon.value_temp3</a>
<li><a href="#Variable-mon_002eaverage_005ftemp3">Variable mon.average_temp3</a>
<li><a href="#Variable-mon_002estddev_005ftemp3">Variable mon.stddev_temp3</a>
<li><a href="#Variable-mon_002evalue_005fcpu">Variable mon.value_cpu</a>
<li><a href="#Variable-mon_002eaverage_005fcpu">Variable mon.average_cpu</a>
<li><a href="#Variable-mon_002estddev_005fcpu">Variable mon.stddev_cpu</a>
<li><a href="#Variable-mon_002evalue_005fcpu0">Variable mon.value_cpu0</a>
<li><a href="#Variable-mon_002eaverage_005fcpu0">Variable mon.average_cpu0</a>
<li><a href="#Variable-mon_002estddev_005fcpu0">Variable mon.stddev_cpu0</a>
<li><a href="#Variable-mon_002evalue_005fcpu1">Variable mon.value_cpu1</a>
<li><a href="#Variable-mon_002eaverage_005fcpu1">Variable mon.average_cpu1</a>
<li><a href="#Variable-mon_002estddev_005fcpu1">Variable mon.stddev_cpu1</a>
<li><a href="#Variable-mon_002evalue_005fcpu2">Variable mon.value_cpu2</a>
<li><a href="#Variable-mon_002eaverage_005fcpu2">Variable mon.average_cpu2</a>
<li><a href="#Variable-mon_002estddev_005fcpu2">Variable mon.stddev_cpu2</a>
<li><a href="#Variable-mon_002evalue_005fcpu3">Variable mon.value_cpu3</a>
<li><a href="#Variable-mon_002eaverage_005fcpu3">Variable mon.average_cpu3</a>
<li><a href="#Variable-mon_002estddev_005fcpu3">Variable mon.stddev_cpu3</a>
</ul>

<div class="node">
<p><hr>
<a name="Variable-mon.value_users"></a>
<a name="Variable-mon_002evalue_005fusers"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fusers">Variable mon.average_users</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-context-mon">Variable context mon</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.1 Variable mon.value_users</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>Users logged in</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_users"></a>
<a name="Variable-mon_002eaverage_005fusers"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fusers">Variable mon.stddev_users</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fusers">Variable mon.value_users</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.2 Variable mon.average_users</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>Users logged in</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_users"></a>
<a name="Variable-mon_002estddev_005fusers"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005frootprocs">Variable mon.value_rootprocs</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fusers">Variable mon.average_users</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.3 Variable mon.stddev_users</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>Users logged in</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_rootprocs"></a>
<a name="Variable-mon_002evalue_005frootprocs"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005frootprocs">Variable mon.average_rootprocs</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fusers">Variable mon.stddev_users</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.4 Variable mon.value_rootprocs</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>Privileged system processes</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_rootprocs"></a>
<a name="Variable-mon_002eaverage_005frootprocs"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005frootprocs">Variable mon.stddev_rootprocs</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005frootprocs">Variable mon.value_rootprocs</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.5 Variable mon.average_rootprocs</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>Privileged system processes</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_rootprocs"></a>
<a name="Variable-mon_002estddev_005frootprocs"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fotherprocs">Variable mon.value_otherprocs</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005frootprocs">Variable mon.average_rootprocs</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.6 Variable mon.stddev_rootprocs</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>Privileged system processes</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_otherprocs"></a>
<a name="Variable-mon_002evalue_005fotherprocs"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fotherprocs">Variable mon.average_otherprocs</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005frootprocs">Variable mon.stddev_rootprocs</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.7 Variable mon.value_otherprocs</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>Non-privileged process</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_otherprocs"></a>
<a name="Variable-mon_002eaverage_005fotherprocs"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fotherprocs">Variable mon.stddev_otherprocs</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fotherprocs">Variable mon.value_otherprocs</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.8 Variable mon.average_otherprocs</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>Non-privileged process</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_otherprocs"></a>
<a name="Variable-mon_002estddev_005fotherprocs"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fdiskfree">Variable mon.value_diskfree</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fotherprocs">Variable mon.average_otherprocs</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.9 Variable mon.stddev_otherprocs</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>Non-privileged process</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_diskfree"></a>
<a name="Variable-mon_002evalue_005fdiskfree"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fdiskfree">Variable mon.average_diskfree</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fotherprocs">Variable mon.stddev_otherprocs</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.10 Variable mon.value_diskfree</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>Free disk on / partition</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_diskfree"></a>
<a name="Variable-mon_002eaverage_005fdiskfree"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fdiskfree">Variable mon.stddev_diskfree</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fdiskfree">Variable mon.value_diskfree</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.11 Variable mon.average_diskfree</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>Free disk on / partition</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_diskfree"></a>
<a name="Variable-mon_002estddev_005fdiskfree"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005floadavg">Variable mon.value_loadavg</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fdiskfree">Variable mon.average_diskfree</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.12 Variable mon.stddev_diskfree</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>Free disk on / partition</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_loadavg"></a>
<a name="Variable-mon_002evalue_005floadavg"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005floadavg">Variable mon.average_loadavg</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fdiskfree">Variable mon.stddev_diskfree</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.13 Variable mon.value_loadavg</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>% kernel load utilization</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_loadavg"></a>
<a name="Variable-mon_002eaverage_005floadavg"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005floadavg">Variable mon.stddev_loadavg</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005floadavg">Variable mon.value_loadavg</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.14 Variable mon.average_loadavg</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>% kernel load utilization</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_loadavg"></a>
<a name="Variable-mon_002estddev_005floadavg"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fnetbiosns_005fin">Variable mon.value_netbiosns_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005floadavg">Variable mon.average_loadavg</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.15 Variable mon.stddev_loadavg</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>% kernel load utilization</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_netbiosns_in"></a>
<a name="Variable-mon_002evalue_005fnetbiosns_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fnetbiosns_005fin">Variable mon.average_netbiosns_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005floadavg">Variable mon.stddev_loadavg</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.16 Variable mon.value_netbiosns_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>netbios name lookups (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_netbiosns_in"></a>
<a name="Variable-mon_002eaverage_005fnetbiosns_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fnetbiosns_005fin">Variable mon.stddev_netbiosns_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fnetbiosns_005fin">Variable mon.value_netbiosns_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.17 Variable mon.average_netbiosns_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>netbios name lookups (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_netbiosns_in"></a>
<a name="Variable-mon_002estddev_005fnetbiosns_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fnetbiosns_005fout">Variable mon.value_netbiosns_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fnetbiosns_005fin">Variable mon.average_netbiosns_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.18 Variable mon.stddev_netbiosns_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>netbios name lookups (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_netbiosns_out"></a>
<a name="Variable-mon_002evalue_005fnetbiosns_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fnetbiosns_005fout">Variable mon.average_netbiosns_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fnetbiosns_005fin">Variable mon.stddev_netbiosns_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.19 Variable mon.value_netbiosns_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>netbios name lookups (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_netbiosns_out"></a>
<a name="Variable-mon_002eaverage_005fnetbiosns_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fnetbiosns_005fout">Variable mon.stddev_netbiosns_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fnetbiosns_005fout">Variable mon.value_netbiosns_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.20 Variable mon.average_netbiosns_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>netbios name lookups (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_netbiosns_out"></a>
<a name="Variable-mon_002estddev_005fnetbiosns_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fnetbiosdgm_005fin">Variable mon.value_netbiosdgm_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fnetbiosns_005fout">Variable mon.average_netbiosns_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.21 Variable mon.stddev_netbiosns_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>netbios name lookups (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_netbiosdgm_in"></a>
<a name="Variable-mon_002evalue_005fnetbiosdgm_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fnetbiosdgm_005fin">Variable mon.average_netbiosdgm_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fnetbiosns_005fout">Variable mon.stddev_netbiosns_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.22 Variable mon.value_netbiosdgm_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>netbios name datagrams (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_netbiosdgm_in"></a>
<a name="Variable-mon_002eaverage_005fnetbiosdgm_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fnetbiosdgm_005fin">Variable mon.stddev_netbiosdgm_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fnetbiosdgm_005fin">Variable mon.value_netbiosdgm_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.23 Variable mon.average_netbiosdgm_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>netbios name datagrams (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_netbiosdgm_in"></a>
<a name="Variable-mon_002estddev_005fnetbiosdgm_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fnetbiosdgm_005fout">Variable mon.value_netbiosdgm_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fnetbiosdgm_005fin">Variable mon.average_netbiosdgm_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.24 Variable mon.stddev_netbiosdgm_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>netbios name datagrams (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_netbiosdgm_out"></a>
<a name="Variable-mon_002evalue_005fnetbiosdgm_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fnetbiosdgm_005fout">Variable mon.average_netbiosdgm_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fnetbiosdgm_005fin">Variable mon.stddev_netbiosdgm_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.25 Variable mon.value_netbiosdgm_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>netbios name datagrams (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_netbiosdgm_out"></a>
<a name="Variable-mon_002eaverage_005fnetbiosdgm_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fnetbiosdgm_005fout">Variable mon.stddev_netbiosdgm_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fnetbiosdgm_005fout">Variable mon.value_netbiosdgm_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.26 Variable mon.average_netbiosdgm_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>netbios name datagrams (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_netbiosdgm_out"></a>
<a name="Variable-mon_002estddev_005fnetbiosdgm_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fnetbiosssn_005fin">Variable mon.value_netbiosssn_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fnetbiosdgm_005fout">Variable mon.average_netbiosdgm_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.27 Variable mon.stddev_netbiosdgm_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>netbios name datagrams (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_netbiosssn_in"></a>
<a name="Variable-mon_002evalue_005fnetbiosssn_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fnetbiosssn_005fin">Variable mon.average_netbiosssn_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fnetbiosdgm_005fout">Variable mon.stddev_netbiosdgm_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.28 Variable mon.value_netbiosssn_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>netbios name sessions (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_netbiosssn_in"></a>
<a name="Variable-mon_002eaverage_005fnetbiosssn_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fnetbiosssn_005fin">Variable mon.stddev_netbiosssn_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fnetbiosssn_005fin">Variable mon.value_netbiosssn_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.29 Variable mon.average_netbiosssn_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>netbios name sessions (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_netbiosssn_in"></a>
<a name="Variable-mon_002estddev_005fnetbiosssn_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fnetbiosssn_005fout">Variable mon.value_netbiosssn_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fnetbiosssn_005fin">Variable mon.average_netbiosssn_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.30 Variable mon.stddev_netbiosssn_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>netbios name sessions (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_netbiosssn_out"></a>
<a name="Variable-mon_002evalue_005fnetbiosssn_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fnetbiosssn_005fout">Variable mon.average_netbiosssn_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fnetbiosssn_005fin">Variable mon.stddev_netbiosssn_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.31 Variable mon.value_netbiosssn_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>netbios name sessions (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_netbiosssn_out"></a>
<a name="Variable-mon_002eaverage_005fnetbiosssn_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fnetbiosssn_005fout">Variable mon.stddev_netbiosssn_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fnetbiosssn_005fout">Variable mon.value_netbiosssn_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.32 Variable mon.average_netbiosssn_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>netbios name sessions (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_netbiosssn_out"></a>
<a name="Variable-mon_002estddev_005fnetbiosssn_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005firc_005fin">Variable mon.value_irc_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fnetbiosssn_005fout">Variable mon.average_netbiosssn_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.33 Variable mon.stddev_netbiosssn_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>netbios name sessions (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_irc_in"></a>
<a name="Variable-mon_002evalue_005firc_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005firc_005fin">Variable mon.average_irc_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fnetbiosssn_005fout">Variable mon.stddev_netbiosssn_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.34 Variable mon.value_irc_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>IRC connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_irc_in"></a>
<a name="Variable-mon_002eaverage_005firc_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005firc_005fin">Variable mon.stddev_irc_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005firc_005fin">Variable mon.value_irc_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.35 Variable mon.average_irc_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>IRC connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_irc_in"></a>
<a name="Variable-mon_002estddev_005firc_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005firc_005fout">Variable mon.value_irc_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005firc_005fin">Variable mon.average_irc_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.36 Variable mon.stddev_irc_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>IRC connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_irc_out"></a>
<a name="Variable-mon_002evalue_005firc_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005firc_005fout">Variable mon.average_irc_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005firc_005fin">Variable mon.stddev_irc_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.37 Variable mon.value_irc_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>IRC connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_irc_out"></a>
<a name="Variable-mon_002eaverage_005firc_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005firc_005fout">Variable mon.stddev_irc_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005firc_005fout">Variable mon.value_irc_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.38 Variable mon.average_irc_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>IRC connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_irc_out"></a>
<a name="Variable-mon_002estddev_005firc_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fcfengine_005fin">Variable mon.value_cfengine_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005firc_005fout">Variable mon.average_irc_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.39 Variable mon.stddev_irc_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>IRC connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_cfengine_in"></a>
<a name="Variable-mon_002evalue_005fcfengine_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fcfengine_005fin">Variable mon.average_cfengine_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005firc_005fout">Variable mon.stddev_irc_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.40 Variable mon.value_cfengine_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>cfengine connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_cfengine_in"></a>
<a name="Variable-mon_002eaverage_005fcfengine_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fcfengine_005fin">Variable mon.stddev_cfengine_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fcfengine_005fin">Variable mon.value_cfengine_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.41 Variable mon.average_cfengine_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>cfengine connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_cfengine_in"></a>
<a name="Variable-mon_002estddev_005fcfengine_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fcfengine_005fout">Variable mon.value_cfengine_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fcfengine_005fin">Variable mon.average_cfengine_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.42 Variable mon.stddev_cfengine_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>cfengine connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_cfengine_out"></a>
<a name="Variable-mon_002evalue_005fcfengine_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fcfengine_005fout">Variable mon.average_cfengine_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fcfengine_005fin">Variable mon.stddev_cfengine_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.43 Variable mon.value_cfengine_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>cfengine connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_cfengine_out"></a>
<a name="Variable-mon_002eaverage_005fcfengine_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fcfengine_005fout">Variable mon.stddev_cfengine_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fcfengine_005fout">Variable mon.value_cfengine_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.44 Variable mon.average_cfengine_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>cfengine connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_cfengine_out"></a>
<a name="Variable-mon_002estddev_005fcfengine_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fnfsd_005fin">Variable mon.value_nfsd_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fcfengine_005fout">Variable mon.average_cfengine_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.45 Variable mon.stddev_cfengine_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>cfengine connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_nfsd_in"></a>
<a name="Variable-mon_002evalue_005fnfsd_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fnfsd_005fin">Variable mon.average_nfsd_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fcfengine_005fout">Variable mon.stddev_cfengine_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.46 Variable mon.value_nfsd_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>nfs connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_nfsd_in"></a>
<a name="Variable-mon_002eaverage_005fnfsd_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fnfsd_005fin">Variable mon.stddev_nfsd_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fnfsd_005fin">Variable mon.value_nfsd_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.47 Variable mon.average_nfsd_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>nfs connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_nfsd_in"></a>
<a name="Variable-mon_002estddev_005fnfsd_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fnfsd_005fout">Variable mon.value_nfsd_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fnfsd_005fin">Variable mon.average_nfsd_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.48 Variable mon.stddev_nfsd_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>nfs connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_nfsd_out"></a>
<a name="Variable-mon_002evalue_005fnfsd_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fnfsd_005fout">Variable mon.average_nfsd_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fnfsd_005fin">Variable mon.stddev_nfsd_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.49 Variable mon.value_nfsd_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>nfs connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_nfsd_out"></a>
<a name="Variable-mon_002eaverage_005fnfsd_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fnfsd_005fout">Variable mon.stddev_nfsd_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fnfsd_005fout">Variable mon.value_nfsd_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.50 Variable mon.average_nfsd_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>nfs connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_nfsd_out"></a>
<a name="Variable-mon_002estddev_005fnfsd_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fsmtp_005fin">Variable mon.value_smtp_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fnfsd_005fout">Variable mon.average_nfsd_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.51 Variable mon.stddev_nfsd_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>nfs connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_smtp_in"></a>
<a name="Variable-mon_002evalue_005fsmtp_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fsmtp_005fin">Variable mon.average_smtp_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fnfsd_005fout">Variable mon.stddev_nfsd_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.52 Variable mon.value_smtp_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>smtp connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_smtp_in"></a>
<a name="Variable-mon_002eaverage_005fsmtp_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fsmtp_005fin">Variable mon.stddev_smtp_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fsmtp_005fin">Variable mon.value_smtp_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.53 Variable mon.average_smtp_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>smtp connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_smtp_in"></a>
<a name="Variable-mon_002estddev_005fsmtp_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fsmtp_005fout">Variable mon.value_smtp_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fsmtp_005fin">Variable mon.average_smtp_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.54 Variable mon.stddev_smtp_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>smtp connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_smtp_out"></a>
<a name="Variable-mon_002evalue_005fsmtp_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fsmtp_005fout">Variable mon.average_smtp_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fsmtp_005fin">Variable mon.stddev_smtp_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.55 Variable mon.value_smtp_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>smtp connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_smtp_out"></a>
<a name="Variable-mon_002eaverage_005fsmtp_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fsmtp_005fout">Variable mon.stddev_smtp_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fsmtp_005fout">Variable mon.value_smtp_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.56 Variable mon.average_smtp_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>smtp connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_smtp_out"></a>
<a name="Variable-mon_002estddev_005fsmtp_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fwww_005fin">Variable mon.value_www_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fsmtp_005fout">Variable mon.average_smtp_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.57 Variable mon.stddev_smtp_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>smtp connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_www_in"></a>
<a name="Variable-mon_002evalue_005fwww_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fwww_005fin">Variable mon.average_www_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fsmtp_005fout">Variable mon.stddev_smtp_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.58 Variable mon.value_www_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>www connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_www_in"></a>
<a name="Variable-mon_002eaverage_005fwww_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fwww_005fin">Variable mon.stddev_www_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fwww_005fin">Variable mon.value_www_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.59 Variable mon.average_www_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>www connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_www_in"></a>
<a name="Variable-mon_002estddev_005fwww_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fwww_005fout">Variable mon.value_www_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fwww_005fin">Variable mon.average_www_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.60 Variable mon.stddev_www_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>www connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_www_out"></a>
<a name="Variable-mon_002evalue_005fwww_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fwww_005fout">Variable mon.average_www_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fwww_005fin">Variable mon.stddev_www_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.61 Variable mon.value_www_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>www connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_www_out"></a>
<a name="Variable-mon_002eaverage_005fwww_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fwww_005fout">Variable mon.stddev_www_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fwww_005fout">Variable mon.value_www_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.62 Variable mon.average_www_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>www connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_www_out"></a>
<a name="Variable-mon_002estddev_005fwww_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fftp_005fin">Variable mon.value_ftp_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fwww_005fout">Variable mon.average_www_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.63 Variable mon.stddev_www_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>www connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_ftp_in"></a>
<a name="Variable-mon_002evalue_005fftp_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fftp_005fin">Variable mon.average_ftp_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fwww_005fout">Variable mon.stddev_www_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.64 Variable mon.value_ftp_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>ftp connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_ftp_in"></a>
<a name="Variable-mon_002eaverage_005fftp_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fftp_005fin">Variable mon.stddev_ftp_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fftp_005fin">Variable mon.value_ftp_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.65 Variable mon.average_ftp_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>ftp connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_ftp_in"></a>
<a name="Variable-mon_002estddev_005fftp_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fftp_005fout">Variable mon.value_ftp_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fftp_005fin">Variable mon.average_ftp_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.66 Variable mon.stddev_ftp_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>ftp connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_ftp_out"></a>
<a name="Variable-mon_002evalue_005fftp_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fftp_005fout">Variable mon.average_ftp_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fftp_005fin">Variable mon.stddev_ftp_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.67 Variable mon.value_ftp_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>ftp connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_ftp_out"></a>
<a name="Variable-mon_002eaverage_005fftp_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fftp_005fout">Variable mon.stddev_ftp_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fftp_005fout">Variable mon.value_ftp_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.68 Variable mon.average_ftp_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>ftp connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_ftp_out"></a>
<a name="Variable-mon_002estddev_005fftp_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fssh_005fin">Variable mon.value_ssh_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fftp_005fout">Variable mon.average_ftp_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.69 Variable mon.stddev_ftp_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>ftp connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_ssh_in"></a>
<a name="Variable-mon_002evalue_005fssh_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fssh_005fin">Variable mon.average_ssh_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fftp_005fout">Variable mon.stddev_ftp_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.70 Variable mon.value_ssh_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>ssh connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_ssh_in"></a>
<a name="Variable-mon_002eaverage_005fssh_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fssh_005fin">Variable mon.stddev_ssh_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fssh_005fin">Variable mon.value_ssh_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.71 Variable mon.average_ssh_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>ssh connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_ssh_in"></a>
<a name="Variable-mon_002estddev_005fssh_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fssh_005fout">Variable mon.value_ssh_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fssh_005fin">Variable mon.average_ssh_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.72 Variable mon.stddev_ssh_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>ssh connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_ssh_out"></a>
<a name="Variable-mon_002evalue_005fssh_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fssh_005fout">Variable mon.average_ssh_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fssh_005fin">Variable mon.stddev_ssh_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.73 Variable mon.value_ssh_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>ssh connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_ssh_out"></a>
<a name="Variable-mon_002eaverage_005fssh_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fssh_005fout">Variable mon.stddev_ssh_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fssh_005fout">Variable mon.value_ssh_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.74 Variable mon.average_ssh_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>ssh connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_ssh_out"></a>
<a name="Variable-mon_002estddev_005fssh_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fwwws_005fin">Variable mon.value_wwws_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fssh_005fout">Variable mon.average_ssh_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.75 Variable mon.stddev_ssh_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>ssh connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_wwws_in"></a>
<a name="Variable-mon_002evalue_005fwwws_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fwwws_005fin">Variable mon.average_wwws_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fssh_005fout">Variable mon.stddev_ssh_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.76 Variable mon.value_wwws_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>wwws connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_wwws_in"></a>
<a name="Variable-mon_002eaverage_005fwwws_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fwwws_005fin">Variable mon.stddev_wwws_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fwwws_005fin">Variable mon.value_wwws_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.77 Variable mon.average_wwws_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>wwws connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_wwws_in"></a>
<a name="Variable-mon_002estddev_005fwwws_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fwwws_005fout">Variable mon.value_wwws_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fwwws_005fin">Variable mon.average_wwws_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.78 Variable mon.stddev_wwws_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>wwws connections (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_wwws_out"></a>
<a name="Variable-mon_002evalue_005fwwws_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fwwws_005fout">Variable mon.average_wwws_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fwwws_005fin">Variable mon.stddev_wwws_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.79 Variable mon.value_wwws_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>wwws connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_wwws_out"></a>
<a name="Variable-mon_002eaverage_005fwwws_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fwwws_005fout">Variable mon.stddev_wwws_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fwwws_005fout">Variable mon.value_wwws_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.80 Variable mon.average_wwws_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>wwws connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_wwws_out"></a>
<a name="Variable-mon_002estddev_005fwwws_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005ficmp_005fin">Variable mon.value_icmp_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fwwws_005fout">Variable mon.average_wwws_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.81 Variable mon.stddev_wwws_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>wwws connections (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_icmp_in"></a>
<a name="Variable-mon_002evalue_005ficmp_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005ficmp_005fin">Variable mon.average_icmp_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fwwws_005fout">Variable mon.stddev_wwws_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.82 Variable mon.value_icmp_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>ICMP packets (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_icmp_in"></a>
<a name="Variable-mon_002eaverage_005ficmp_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005ficmp_005fin">Variable mon.stddev_icmp_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005ficmp_005fin">Variable mon.value_icmp_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.83 Variable mon.average_icmp_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>ICMP packets (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_icmp_in"></a>
<a name="Variable-mon_002estddev_005ficmp_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005ficmp_005fout">Variable mon.value_icmp_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005ficmp_005fin">Variable mon.average_icmp_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.84 Variable mon.stddev_icmp_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>ICMP packets (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_icmp_out"></a>
<a name="Variable-mon_002evalue_005ficmp_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005ficmp_005fout">Variable mon.average_icmp_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005ficmp_005fin">Variable mon.stddev_icmp_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.85 Variable mon.value_icmp_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>ICMP packets (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_icmp_out"></a>
<a name="Variable-mon_002eaverage_005ficmp_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005ficmp_005fout">Variable mon.stddev_icmp_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005ficmp_005fout">Variable mon.value_icmp_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.86 Variable mon.average_icmp_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>ICMP packets (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_icmp_out"></a>
<a name="Variable-mon_002estddev_005ficmp_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fudp_005fin">Variable mon.value_udp_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005ficmp_005fout">Variable mon.average_icmp_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.87 Variable mon.stddev_icmp_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>ICMP packets (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_udp_in"></a>
<a name="Variable-mon_002evalue_005fudp_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fudp_005fin">Variable mon.average_udp_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005ficmp_005fout">Variable mon.stddev_icmp_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.88 Variable mon.value_udp_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>UDP dgrams (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_udp_in"></a>
<a name="Variable-mon_002eaverage_005fudp_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fudp_005fin">Variable mon.stddev_udp_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fudp_005fin">Variable mon.value_udp_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.89 Variable mon.average_udp_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>UDP dgrams (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_udp_in"></a>
<a name="Variable-mon_002estddev_005fudp_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fudp_005fout">Variable mon.value_udp_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fudp_005fin">Variable mon.average_udp_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.90 Variable mon.stddev_udp_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>UDP dgrams (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_udp_out"></a>
<a name="Variable-mon_002evalue_005fudp_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fudp_005fout">Variable mon.average_udp_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fudp_005fin">Variable mon.stddev_udp_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.91 Variable mon.value_udp_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>UDP dgrams (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_udp_out"></a>
<a name="Variable-mon_002eaverage_005fudp_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fudp_005fout">Variable mon.stddev_udp_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fudp_005fout">Variable mon.value_udp_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.92 Variable mon.average_udp_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>UDP dgrams (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_udp_out"></a>
<a name="Variable-mon_002estddev_005fudp_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fdns_005fin">Variable mon.value_dns_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fudp_005fout">Variable mon.average_udp_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.93 Variable mon.stddev_udp_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>UDP dgrams (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_dns_in"></a>
<a name="Variable-mon_002evalue_005fdns_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fdns_005fin">Variable mon.average_dns_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fudp_005fout">Variable mon.stddev_udp_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.94 Variable mon.value_dns_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>DNS requests (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_dns_in"></a>
<a name="Variable-mon_002eaverage_005fdns_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fdns_005fin">Variable mon.stddev_dns_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fdns_005fin">Variable mon.value_dns_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.95 Variable mon.average_dns_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>DNS requests (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_dns_in"></a>
<a name="Variable-mon_002estddev_005fdns_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fdns_005fout">Variable mon.value_dns_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fdns_005fin">Variable mon.average_dns_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.96 Variable mon.stddev_dns_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>DNS requests (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_dns_out"></a>
<a name="Variable-mon_002evalue_005fdns_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fdns_005fout">Variable mon.average_dns_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fdns_005fin">Variable mon.stddev_dns_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.97 Variable mon.value_dns_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>DNS requests (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_dns_out"></a>
<a name="Variable-mon_002eaverage_005fdns_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fdns_005fout">Variable mon.stddev_dns_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fdns_005fout">Variable mon.value_dns_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.98 Variable mon.average_dns_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>DNS requests (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_dns_out"></a>
<a name="Variable-mon_002estddev_005fdns_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005ftcpsyn_005fin">Variable mon.value_tcpsyn_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fdns_005fout">Variable mon.average_dns_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.99 Variable mon.stddev_dns_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>DNS requests (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_tcpsyn_in"></a>
<a name="Variable-mon_002evalue_005ftcpsyn_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005ftcpsyn_005fin">Variable mon.average_tcpsyn_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fdns_005fout">Variable mon.stddev_dns_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.100 Variable mon.value_tcpsyn_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP sessions (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_tcpsyn_in"></a>
<a name="Variable-mon_002eaverage_005ftcpsyn_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005ftcpsyn_005fin">Variable mon.stddev_tcpsyn_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005ftcpsyn_005fin">Variable mon.value_tcpsyn_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.101 Variable mon.average_tcpsyn_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP sessions (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_tcpsyn_in"></a>
<a name="Variable-mon_002estddev_005ftcpsyn_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005ftcpsyn_005fout">Variable mon.value_tcpsyn_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005ftcpsyn_005fin">Variable mon.average_tcpsyn_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.102 Variable mon.stddev_tcpsyn_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP sessions (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_tcpsyn_out"></a>
<a name="Variable-mon_002evalue_005ftcpsyn_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005ftcpsyn_005fout">Variable mon.average_tcpsyn_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005ftcpsyn_005fin">Variable mon.stddev_tcpsyn_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.103 Variable mon.value_tcpsyn_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP sessions (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_tcpsyn_out"></a>
<a name="Variable-mon_002eaverage_005ftcpsyn_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005ftcpsyn_005fout">Variable mon.stddev_tcpsyn_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005ftcpsyn_005fout">Variable mon.value_tcpsyn_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.104 Variable mon.average_tcpsyn_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP sessions (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_tcpsyn_out"></a>
<a name="Variable-mon_002estddev_005ftcpsyn_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005ftcpack_005fin">Variable mon.value_tcpack_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005ftcpsyn_005fout">Variable mon.average_tcpsyn_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.105 Variable mon.stddev_tcpsyn_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP sessions (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_tcpack_in"></a>
<a name="Variable-mon_002evalue_005ftcpack_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005ftcpack_005fin">Variable mon.average_tcpack_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005ftcpsyn_005fout">Variable mon.stddev_tcpsyn_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.106 Variable mon.value_tcpack_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP acks (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_tcpack_in"></a>
<a name="Variable-mon_002eaverage_005ftcpack_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005ftcpack_005fin">Variable mon.stddev_tcpack_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005ftcpack_005fin">Variable mon.value_tcpack_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.107 Variable mon.average_tcpack_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP acks (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_tcpack_in"></a>
<a name="Variable-mon_002estddev_005ftcpack_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005ftcpack_005fout">Variable mon.value_tcpack_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005ftcpack_005fin">Variable mon.average_tcpack_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.108 Variable mon.stddev_tcpack_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP acks (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_tcpack_out"></a>
<a name="Variable-mon_002evalue_005ftcpack_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005ftcpack_005fout">Variable mon.average_tcpack_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005ftcpack_005fin">Variable mon.stddev_tcpack_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.109 Variable mon.value_tcpack_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP acks (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_tcpack_out"></a>
<a name="Variable-mon_002eaverage_005ftcpack_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005ftcpack_005fout">Variable mon.stddev_tcpack_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005ftcpack_005fout">Variable mon.value_tcpack_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.110 Variable mon.average_tcpack_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP acks (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_tcpack_out"></a>
<a name="Variable-mon_002estddev_005ftcpack_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005ftcpfin_005fin">Variable mon.value_tcpfin_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005ftcpack_005fout">Variable mon.average_tcpack_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.111 Variable mon.stddev_tcpack_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP acks (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_tcpfin_in"></a>
<a name="Variable-mon_002evalue_005ftcpfin_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005ftcpfin_005fin">Variable mon.average_tcpfin_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005ftcpack_005fout">Variable mon.stddev_tcpack_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.112 Variable mon.value_tcpfin_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP finish (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_tcpfin_in"></a>
<a name="Variable-mon_002eaverage_005ftcpfin_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005ftcpfin_005fin">Variable mon.stddev_tcpfin_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005ftcpfin_005fin">Variable mon.value_tcpfin_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.113 Variable mon.average_tcpfin_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP finish (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_tcpfin_in"></a>
<a name="Variable-mon_002estddev_005ftcpfin_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005ftcpfin_005fout">Variable mon.value_tcpfin_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005ftcpfin_005fin">Variable mon.average_tcpfin_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.114 Variable mon.stddev_tcpfin_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP finish (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_tcpfin_out"></a>
<a name="Variable-mon_002evalue_005ftcpfin_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005ftcpfin_005fout">Variable mon.average_tcpfin_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005ftcpfin_005fin">Variable mon.stddev_tcpfin_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.115 Variable mon.value_tcpfin_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP finish (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_tcpfin_out"></a>
<a name="Variable-mon_002eaverage_005ftcpfin_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005ftcpfin_005fout">Variable mon.stddev_tcpfin_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005ftcpfin_005fout">Variable mon.value_tcpfin_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.116 Variable mon.average_tcpfin_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP finish (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_tcpfin_out"></a>
<a name="Variable-mon_002estddev_005ftcpfin_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005ftcpmisc_005fin">Variable mon.value_tcpmisc_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005ftcpfin_005fout">Variable mon.average_tcpfin_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.117 Variable mon.stddev_tcpfin_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP finish (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_tcpmisc_in"></a>
<a name="Variable-mon_002evalue_005ftcpmisc_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005ftcpmisc_005fin">Variable mon.average_tcpmisc_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005ftcpfin_005fout">Variable mon.stddev_tcpfin_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.118 Variable mon.value_tcpmisc_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP misc (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_tcpmisc_in"></a>
<a name="Variable-mon_002eaverage_005ftcpmisc_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005ftcpmisc_005fin">Variable mon.stddev_tcpmisc_in</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005ftcpmisc_005fin">Variable mon.value_tcpmisc_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.119 Variable mon.average_tcpmisc_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP misc (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_tcpmisc_in"></a>
<a name="Variable-mon_002estddev_005ftcpmisc_005fin"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005ftcpmisc_005fout">Variable mon.value_tcpmisc_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005ftcpmisc_005fin">Variable mon.average_tcpmisc_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.120 Variable mon.stddev_tcpmisc_in</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP misc (in)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_tcpmisc_out"></a>
<a name="Variable-mon_002evalue_005ftcpmisc_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005ftcpmisc_005fout">Variable mon.average_tcpmisc_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005ftcpmisc_005fin">Variable mon.stddev_tcpmisc_in</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.121 Variable mon.value_tcpmisc_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP misc (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_tcpmisc_out"></a>
<a name="Variable-mon_002eaverage_005ftcpmisc_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005ftcpmisc_005fout">Variable mon.stddev_tcpmisc_out</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005ftcpmisc_005fout">Variable mon.value_tcpmisc_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.122 Variable mon.average_tcpmisc_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP misc (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_tcpmisc_out"></a>
<a name="Variable-mon_002estddev_005ftcpmisc_005fout"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fwebaccess">Variable mon.value_webaccess</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005ftcpmisc_005fout">Variable mon.average_tcpmisc_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.123 Variable mon.stddev_tcpmisc_out</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>TCP misc (out)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_webaccess"></a>
<a name="Variable-mon_002evalue_005fwebaccess"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fwebaccess">Variable mon.average_webaccess</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005ftcpmisc_005fout">Variable mon.stddev_tcpmisc_out</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.124 Variable mon.value_webaccess</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>Webserver hits</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_webaccess"></a>
<a name="Variable-mon_002eaverage_005fwebaccess"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fwebaccess">Variable mon.stddev_webaccess</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fwebaccess">Variable mon.value_webaccess</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.125 Variable mon.average_webaccess</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>Webserver hits</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_webaccess"></a>
<a name="Variable-mon_002estddev_005fwebaccess"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fweberrors">Variable mon.value_weberrors</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fwebaccess">Variable mon.average_webaccess</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.126 Variable mon.stddev_webaccess</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>Webserver hits</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_weberrors"></a>
<a name="Variable-mon_002evalue_005fweberrors"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fweberrors">Variable mon.average_weberrors</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fwebaccess">Variable mon.stddev_webaccess</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.127 Variable mon.value_weberrors</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>Webserver errors</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_weberrors"></a>
<a name="Variable-mon_002eaverage_005fweberrors"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fweberrors">Variable mon.stddev_weberrors</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fweberrors">Variable mon.value_weberrors</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.128 Variable mon.average_weberrors</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>Webserver errors</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_weberrors"></a>
<a name="Variable-mon_002estddev_005fweberrors"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fsyslog">Variable mon.value_syslog</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fweberrors">Variable mon.average_weberrors</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.129 Variable mon.stddev_weberrors</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>Webserver errors</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_syslog"></a>
<a name="Variable-mon_002evalue_005fsyslog"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fsyslog">Variable mon.average_syslog</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fweberrors">Variable mon.stddev_weberrors</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.130 Variable mon.value_syslog</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>New log entries (Syslog)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_syslog"></a>
<a name="Variable-mon_002eaverage_005fsyslog"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fsyslog">Variable mon.stddev_syslog</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fsyslog">Variable mon.value_syslog</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.131 Variable mon.average_syslog</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>New log entries (Syslog)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_syslog"></a>
<a name="Variable-mon_002estddev_005fsyslog"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fmessages">Variable mon.value_messages</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fsyslog">Variable mon.average_syslog</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.132 Variable mon.stddev_syslog</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>New log entries (Syslog)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_messages"></a>
<a name="Variable-mon_002evalue_005fmessages"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fmessages">Variable mon.average_messages</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fsyslog">Variable mon.stddev_syslog</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.133 Variable mon.value_messages</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>New log entries (messages)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_messages"></a>
<a name="Variable-mon_002eaverage_005fmessages"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fmessages">Variable mon.stddev_messages</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fmessages">Variable mon.value_messages</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.134 Variable mon.average_messages</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>New log entries (messages)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_messages"></a>
<a name="Variable-mon_002estddev_005fmessages"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005ftemp0">Variable mon.value_temp0</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fmessages">Variable mon.average_messages</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.135 Variable mon.stddev_messages</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>New log entries (messages)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_temp0"></a>
<a name="Variable-mon_002evalue_005ftemp0"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005ftemp0">Variable mon.average_temp0</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fmessages">Variable mon.stddev_messages</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.136 Variable mon.value_temp0</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>CPU Temperature 0</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_temp0"></a>
<a name="Variable-mon_002eaverage_005ftemp0"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005ftemp0">Variable mon.stddev_temp0</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005ftemp0">Variable mon.value_temp0</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.137 Variable mon.average_temp0</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>CPU Temperature 0</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_temp0"></a>
<a name="Variable-mon_002estddev_005ftemp0"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005ftemp1">Variable mon.value_temp1</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005ftemp0">Variable mon.average_temp0</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.138 Variable mon.stddev_temp0</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>CPU Temperature 0</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_temp1"></a>
<a name="Variable-mon_002evalue_005ftemp1"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005ftemp1">Variable mon.average_temp1</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005ftemp0">Variable mon.stddev_temp0</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.139 Variable mon.value_temp1</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>CPU Temperature 1</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_temp1"></a>
<a name="Variable-mon_002eaverage_005ftemp1"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005ftemp1">Variable mon.stddev_temp1</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005ftemp1">Variable mon.value_temp1</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.140 Variable mon.average_temp1</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>CPU Temperature 1</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_temp1"></a>
<a name="Variable-mon_002estddev_005ftemp1"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005ftemp2">Variable mon.value_temp2</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005ftemp1">Variable mon.average_temp1</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.141 Variable mon.stddev_temp1</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>CPU Temperature 1</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_temp2"></a>
<a name="Variable-mon_002evalue_005ftemp2"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005ftemp2">Variable mon.average_temp2</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005ftemp1">Variable mon.stddev_temp1</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.142 Variable mon.value_temp2</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>CPU Temperature 2</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_temp2"></a>
<a name="Variable-mon_002eaverage_005ftemp2"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005ftemp2">Variable mon.stddev_temp2</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005ftemp2">Variable mon.value_temp2</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.143 Variable mon.average_temp2</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>CPU Temperature 2</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_temp2"></a>
<a name="Variable-mon_002estddev_005ftemp2"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005ftemp3">Variable mon.value_temp3</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005ftemp2">Variable mon.average_temp2</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.144 Variable mon.stddev_temp2</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>CPU Temperature 2</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_temp3"></a>
<a name="Variable-mon_002evalue_005ftemp3"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005ftemp3">Variable mon.average_temp3</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005ftemp2">Variable mon.stddev_temp2</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.145 Variable mon.value_temp3</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>CPU Temperature 3</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_temp3"></a>
<a name="Variable-mon_002eaverage_005ftemp3"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005ftemp3">Variable mon.stddev_temp3</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005ftemp3">Variable mon.value_temp3</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.146 Variable mon.average_temp3</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>CPU Temperature 3</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_temp3"></a>
<a name="Variable-mon_002estddev_005ftemp3"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fcpu">Variable mon.value_cpu</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005ftemp3">Variable mon.average_temp3</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.147 Variable mon.stddev_temp3</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>CPU Temperature 3</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_cpu"></a>
<a name="Variable-mon_002evalue_005fcpu"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fcpu">Variable mon.average_cpu</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005ftemp3">Variable mon.stddev_temp3</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.148 Variable mon.value_cpu</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>%CPU utilization (all)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_cpu"></a>
<a name="Variable-mon_002eaverage_005fcpu"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fcpu">Variable mon.stddev_cpu</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fcpu">Variable mon.value_cpu</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.149 Variable mon.average_cpu</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>%CPU utilization (all)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_cpu"></a>
<a name="Variable-mon_002estddev_005fcpu"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fcpu0">Variable mon.value_cpu0</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fcpu">Variable mon.average_cpu</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.150 Variable mon.stddev_cpu</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>%CPU utilization (all)</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_cpu0"></a>
<a name="Variable-mon_002evalue_005fcpu0"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fcpu0">Variable mon.average_cpu0</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fcpu">Variable mon.stddev_cpu</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.151 Variable mon.value_cpu0</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>%CPU utilization 0</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_cpu0"></a>
<a name="Variable-mon_002eaverage_005fcpu0"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fcpu0">Variable mon.stddev_cpu0</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fcpu0">Variable mon.value_cpu0</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.152 Variable mon.average_cpu0</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>%CPU utilization 0</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_cpu0"></a>
<a name="Variable-mon_002estddev_005fcpu0"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fcpu1">Variable mon.value_cpu1</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fcpu0">Variable mon.average_cpu0</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.153 Variable mon.stddev_cpu0</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>%CPU utilization 0</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_cpu1"></a>
<a name="Variable-mon_002evalue_005fcpu1"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fcpu1">Variable mon.average_cpu1</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fcpu0">Variable mon.stddev_cpu0</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.154 Variable mon.value_cpu1</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>%CPU utilization 1</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_cpu1"></a>
<a name="Variable-mon_002eaverage_005fcpu1"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fcpu1">Variable mon.stddev_cpu1</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fcpu1">Variable mon.value_cpu1</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.155 Variable mon.average_cpu1</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>%CPU utilization 1</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_cpu1"></a>
<a name="Variable-mon_002estddev_005fcpu1"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fcpu2">Variable mon.value_cpu2</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fcpu1">Variable mon.average_cpu1</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.156 Variable mon.stddev_cpu1</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>%CPU utilization 1</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_cpu2"></a>
<a name="Variable-mon_002evalue_005fcpu2"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fcpu2">Variable mon.average_cpu2</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fcpu1">Variable mon.stddev_cpu1</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.157 Variable mon.value_cpu2</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>%CPU utilization 2</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_cpu2"></a>
<a name="Variable-mon_002eaverage_005fcpu2"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fcpu2">Variable mon.stddev_cpu2</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fcpu2">Variable mon.value_cpu2</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.158 Variable mon.average_cpu2</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>%CPU utilization 2</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_cpu2"></a>
<a name="Variable-mon_002estddev_005fcpu2"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002evalue_005fcpu3">Variable mon.value_cpu3</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fcpu2">Variable mon.average_cpu2</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.159 Variable mon.stddev_cpu2</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>%CPU utilization 2</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.value_cpu3"></a>
<a name="Variable-mon_002evalue_005fcpu3"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002eaverage_005fcpu3">Variable mon.average_cpu3</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002estddev_005fcpu2">Variable mon.stddev_cpu2</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.160 Variable mon.value_cpu3</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>%CPU utilization 3</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.average_cpu3"></a>
<a name="Variable-mon_002eaverage_005fcpu3"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Variable-mon_002estddev_005fcpu3">Variable mon.stddev_cpu3</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002evalue_005fcpu3">Variable mon.value_cpu3</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.161 Variable mon.average_cpu3</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>%CPU utilization 3</var>. 
<div class="node">
<p><hr>
<a name="Variable-mon.stddev_cpu3"></a>
<a name="Variable-mon_002estddev_005fcpu3"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Variable-mon_002eaverage_005fcpu3">Variable mon.average_cpu3</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Variable-context-mon">Variable context mon</a>

</div>

<h4 class="subsection">12.3.162 Variable mon.stddev_cpu3</h4>

<p>Observational measure collected every 2.5 minutes from cf-monitord, description: <var>%CPU utilization 3</var>.<!-- ***************************************************** -->
<!-- * CHAPTER -->
<!-- ***************************************************** -->
<div class="node">
<p><hr>
<a name="Logs-and-records"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Special-Variables">Special Variables</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Top">Top</a>

</div>

<h2 class="chapter">13 Logs and records</h2>

<p><br>

   <p>Cfengine writes numerous logs and records to its private workspace,
referred to as <samp><span class="file">WORKDIR</span></samp>. This chapter makes some brief notes
about these files. Cfengine approaches monitoring and reporting from
the viewpoint of scalability so there is no default centralizatio of
reporting information, as this is untenable for more than a few
hundred hosts. Instead, in the classic cfengine way, every host
is reponsible for its own data. Solutions for centralization and
netwide reporting will be given elsewhere.

   <p>The filenames referred to in this section are all relative to the
cfengine work directory <samp><span class="file">WORKDIR</span></samp>.

<ul class="menu">
<li><a accesskey="1" href="#Embedded-Databases">Embedded Databases</a>
<li><a accesskey="2" href="#Text-logs">Text logs</a>
<li><a accesskey="3" href="#Reports-in-outputs">Reports in outputs</a>
<li><a accesskey="4" href="#Additional-reports-in-commcerical-cfengine-versions">Additional reports in commcerical cfengine versions</a>
<li><a accesskey="5" href="#State-information">State information</a>
</ul>

<div class="node">
<p><hr>
<a name="Embedded-Databases"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Text-logs">Text logs</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Logs-and-records">Logs and records</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Logs-and-records">Logs and records</a>

</div>

<h3 class="section">13.1 Embedded Databases</h3>

<p>The embedded databases can be viewed and printed using the reporting
tool <code>cf-report</code>.

     <dl>
<dt><samp><span class="file">cf_Audit.db</span></samp><dd>A compressed database of auditing information. This file grows very large
is auditing is switched on. By default, only minor information about cfengine runs
are recorded. This file should be archived and deleted regularly to avoid choking
the system. 
<br><dt><samp><span class="file">cf_LastSeen.db</span></samp><dd>A database of hosts that last contacted this host, or were contacted by this
host which includes the times at which they were last observed. 
<br><dt><samp><span class="file">cf_classes.db</span></samp><dd>A database of classes that have been defined on the current host, including
their relative frequences, scaled like a probability.

     <br><dt><samp><span class="file">checksum_digests.db</span></samp><dd>The database of hash values used in cfengine's change management functions. 
<br><dt><samp><span class="file">performance.db</span></samp><dd>A database of last, average and deviation times of jobs recorded by <code>cf-agent</code>. 
Most promises take an immeasurablely short time to check, but longer
tasks such as command execution and file copying are measured by default. 
Other checks can be instrumented by setting a <code>measurement_class</code>
in the <code>action</code> body of a promise. 
<br><dt><samp><span class="file">cfengine_lock_db</span></samp><dd>A database of active and inactive locks and their expiry times. Deleting
this database will reset all lock protections in cfengine.

     <br><dt><samp><span class="file">stats.db</span></samp><dd>A database of external file attributes for change management functionality.

     <br><dt><samp><span class="file">state/history.db</span></samp><dd>Enterprise level versions of cfengine maintain this long-term trend database.

     <br><dt><samp><span class="file">state/cf_observations.db</span></samp><dd>This database contains the current state of the observational history
of the host as recorded by <code>cf-monitord</code>.

     <br><dt><samp><span class="file">state/promise_compliance.db</span></samp><dd>Enterprise cfengine (Nova and above) database of individual promise compliance history. 
The database is approximate because promise references can change as policy is
edited. It quickly approaches accuracy as a policy goes unchanged for more than a day.

     <br><dt><samp><span class="file">state/cf_state.db</span></samp><dd>A database of persistent classes active on this current host.

     <br><dt><samp><span class="file">state/nova_measures.db</span></samp><dd>Enterprise cfengine (Nova and above) database of custom measurables. 
<br><dt><samp><span class="file">state/nova_static.db</span></samp><dd>Enterprise cfengine (Nova and above) database of static system discovery data. 
</dl>

<div class="node">
<p><hr>
<a name="Text-logs"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Reports-in-outputs">Reports in outputs</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Embedded-Databases">Embedded Databases</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Logs-and-records">Logs and records</a>

</div>

<h3 class="section">13.2 Text logs</h3>

     <dl>
<dt><samp><span class="file">promise.log</span></samp><dd>A time-stamped log of the percentage fraction of promises kept after each run. 
<br><dt><samp><span class="file">cf3.HOSTNAME.runlog</span></samp><dd>A time-stamped log of when each lock was released. This shows the last
time each individual promise was verified. 
<br><dt><samp><span class="file">cfagent.HOSTNAME.log</span></samp><dd>Although ambiguously named (for historical reasons) this log contains the current
list of setuid/setgid programs observed on the system. Cfengine warns about
new additions to this list.

     <br><dt><samp><span class="file">reports/*</span></samp><dd>Enterprise versions of cfengine use this directory as a default place for
outputting reports.

     <br><dt><samp><span class="file">reports/class_notes</span></samp><dd>Class data in csv format for export to CMDB.

     <br><dt><samp><span class="file">state/file_hash_event_history</span></samp><dd>A time-stamped log of which files have experienced content changes
since the last observation, as determined by the hashing algorithms in
cfengine.

     <br><dt><samp><span class="file">state/nova_*.db</span></samp><dd>Enterprise level cfengine's use these data for storing custom system measurements.

     <br><dt><samp><span class="file">state/vars.out</span></samp><dd>Enterprise level versions of cfengine use this log to communicate variable
data.

     <br><dt><samp><span class="file">state/*_measure.log</span></samp><dd>Enterprise level versions of cfengine maintain user-defined logs based on
specifically promised observations of the system.

</dl>

<div class="node">
<p><hr>
<a name="Reports-in-outputs"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#Additional-reports-in-commcerical-cfengine-versions">Additional reports in commcerical cfengine versions</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Text-logs">Text logs</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Logs-and-records">Logs and records</a>

</div>

<h3 class="section">13.3 Reports in outputs</h3>

<p>The <samp><span class="file">outputs</span></samp> directory contains a time-stamped list of outputs
generated by <code>cf-agent</code>. These are collected by <code>cf-execd</code>
and are often E-mailed as reports. However, not all hosts have an
E-mail capability or are online, so the reports are kept here. Reports
are not tidied automatically, so you should delete these files after a
time to avoid a build up.

<div class="node">
<p><hr>
<a name="Additional-reports-in-commcerical-cfengine-versions"></a>
Next:&nbsp;<a rel="next" accesskey="n" href="#State-information">State information</a>,
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Reports-in-outputs">Reports in outputs</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Logs-and-records">Logs and records</a>

</div>

<h3 class="section">13.4 Additional reports in commcerical cfengine versions</h3>

<div class="node">
<p><hr>
<a name="State-information"></a>
Previous:&nbsp;<a rel="previous" accesskey="p" href="#Additional-reports-in-commcerical-cfengine-versions">Additional reports in commcerical cfengine versions</a>,
Up:&nbsp;<a rel="up" accesskey="u" href="#Logs-and-records">Logs and records</a>

</div>

<h3 class="section">13.5 State information</h3>

<p>The cfengine components keep their current process identifier number
in `pid files' in the work directory: e.g.

<pre class="verbatim">cf-execd.pid
cf-serverd.pid
</pre>

   <p>Most other state data refer to the running condition of the host and
are generated by <code>cf-monitord</code> (<code>cfenvd</code> in earlier versions
of cfengine).

     <dl>
<dt><samp><span class="file">state/env_data</span></samp><dd>This file contains a list of currently discovered classes and variable values
that characterize the anomaly alert environment. They are altered by the monitor
daemon. 
<br><dt><samp><span class="file">state/all_classes</span></samp><dd>A list of all the classes that were defined the last time that cfengine
was run. 
<br><dt><samp><span class="file">state/cf_*</span></samp><dd>All files that begin with this prefix refer to cached data that were observed
by the monitor daemon, and may be used by <code>cf-agent</code> in <code>reports</code> with <code>showstate</code>. 
</dl>

<!-- ========================================================================= -->
<!-- @node Index,  , Cfengine Methods, Top -->
<!-- @unnumbered Concept Index -->
<!-- @printindex cp -->
<!-- ========================================================================= -->
   <p><a name="Contents">
   <div class="contents">
<h2>Table of Contents</h2>
<ul>
<li><a name="toc_Top" href="#Top">Cfengine-AutoReference</a>
<li><a name="toc_Getting-started" href="#Getting-started">1 Cfengine 3.0.2 &ndash; Getting started</a>
<ul>
<li><a href="#A-renewed-cfengine">1.1 A renewed cfengine</a>
<li><a href="#Installation">1.2 Installation</a>
<li><a href="#Work-directory">1.3 The work directory</a>
<li><a href="#Hard-classes">1.4 Cfengine hard classes</a>
<li><a href="#Global-and-local-classes">1.5 Global and local classes</a>
<li><a href="#Filenames-and-paths">1.6 Filenames and paths</a>
<li><a href="#Upgrading-from-cfengine-2">1.7 Upgrading from cfengine 2</a>
<li><a href="#Testing-as-a-non_002dprivilieged-user">1.8 Testing as a non-privilieged user</a>
<li><a href="#The-bare-necessities-of-a-cfengine-3">1.9 The `bear' necessities of a cfengine 3</a>
<li><a href="#Familiiarizing-yourself">1.10 Familiarizing yourself</a>
<li><a href="#Remote-access-troubleshooting">1.11 Remote access troubleshooting</a>
<ul>
<li><a href="#Server-connection">1.11.1 Server connection</a>
<li><a href="#Key-exchange">1.11.2 Key exchange</a>
<li><a href="#Time-windows">1.11.3 Time windows (races)</a>
<li><a href="#Other-users-than-root">1.11.4 Other users than root</a>
<li><a href="#Encryption">1.11.5 Encryption</a>
</li></ul>
</li></ul>
<li><a name="toc_A-simple-crash-course" href="#A-simple-crash-course">2 A simple crash course in concepts</a>
<ul>
<li><a href="#Rules-are-promises">2.1 Rules are promises</a>
<li><a href="#Best-practice-for-writing-promises">2.2 Best practice for writing promises</a>
<li><a href="#Containers">2.3 Containers</a>
<li><a href="#When-and-where-are-promises-made_003f">2.4 When and where are promises made?</a>
<li><a href="#Types-in-cfengine-3">2.5 Types in cfengine 3</a>
<li><a href="#Datatypes-in-cfengine-3">2.6 Datatypes in cfengine 3</a>
<li><a href="#Variable-expansion-in-cfengine-3">2.7 Variable expansion in cfengine 3</a>
<ul>
<li><a href="#Scalar-variable-expansion">2.7.1 Scalar variable expansion</a>
<li><a href="#List-variable-substitution-and-expansion">2.7.2 List variable substitution and expansion</a>
<li><a href="#Arrays-in-cfengine-3">2.7.3 Arrays in cfengine 3</a>
</li></ul>
<li><a href="#Normal-ordering">2.8 Normal ordering</a>
<li><a href="#Loops-and-lists-in-cfengine-3">2.9 Loops and lists in cfengine 3</a>
<li><a href="#Pattern-matching-and-referencing">2.10 Pattern matching and referencing</a>
<ul>
<li><a href="#Runaway-change-warning">2.10.1 Runaway change warning</a>
<li><a href="#Commenting-lines">2.10.2 Commenting lines</a>
</li></ul>
<li><a href="#Distributed-discovery">2.11 Distributed discovery</a>
<li><a href="#Developer-structures">2.12 Developer structures</a>
</li></ul>
<li><a name="toc_How-to-run-cfengine-3-examples" href="#How-to-run-cfengine-3-examples">3 How to run cfengine 3 examples</a>
<li><a name="toc_A-complete-configuration" href="#A-complete-configuration">4 A complete configuration</a>
<ul>
<li><a href="#promises_002ecf">4.1 <samp><span class="file">promises.cf</span></samp></a>
<li><a href="#site_002ecf">4.2 <samp><span class="file">site.cf</span></samp></a>
<li><a href="#update_002ecf">4.3 <samp><span class="file">update.cf</span></samp></a>
<li><a href="#failsafe_002ecf">4.4 <samp><span class="file">failsafe.cf</span></samp></a>
<li><a href="#What-should-a-failsafe-or-update-file-contain">4.5 What should a failsafe and update file contain?</a>
<li><a href="#Recovery-from-errors-in-the-configuration">4.6 Recovery from errors in the configuration</a>
<li><a href="#Recovery-from-errors-in-the-software">4.7 Recovery from errors in the software</a>
</li></ul>
<li><a name="toc_Control-Promises" href="#Control-Promises">5 Control promises</a>
<ul>
<li><a href="#control-common">5.1 <code>common</code> control promises</a>
<ul>
<li><a href="#bundlesequence-in-common">5.1.1 <code>bundlesequence</code></a>
<li><a href="#inputs-in-common">5.1.2 <code>inputs</code></a>
<li><a href="#version-in-common">5.1.3 <code>version</code></a>
<li><a href="#lastseenexpireafter-in-common">5.1.4 <code>lastseenexpireafter</code></a>
<li><a href="#output_005fprefix-in-common">5.1.5 <code>output_prefix</code></a>
<li><a href="#domain-in-common">5.1.6 <code>domain</code></a>
<li><a href="#require_005fcomments-in-common">5.1.7 <code>require_comments</code></a>
</li></ul>
<li><a href="#control-agent">5.2 <code>agent</code> control promises</a>
<ul>
<li><a href="#abortclasses-in-agent">5.2.1 <code>abortclasses</code></a>
<li><a href="#abortbundleclasses-in-agent">5.2.2 <code>abortbundleclasses</code></a>
<li><a href="#addclasses-in-agent">5.2.3 <code>addclasses</code></a>
<li><a href="#agentaccess-in-agent">5.2.4 <code>agentaccess</code></a>
<li><a href="#agentfacility-in-agent">5.2.5 <code>agentfacility</code></a>
<li><a href="#auditing-in-agent">5.2.6 <code>auditing</code></a>
<li><a href="#binarypaddingchar-in-agent">5.2.7 <code>binarypaddingchar</code></a>
<li><a href="#bindtointerface-in-agent">5.2.8 <code>bindtointerface</code></a>
<li><a href="#hashupdates-in-agent">5.2.9 <code>hashupdates</code></a>
<li><a href="#childlibpath-in-agent">5.2.10 <code>childlibpath</code></a>
<li><a href="#defaultcopytype-in-agent">5.2.11 <code>defaultcopytype</code></a>
<li><a href="#dryrun-in-agent">5.2.12 <code>dryrun</code></a>
<li><a href="#editbinaryfilesize-in-agent">5.2.13 <code>editbinaryfilesize</code></a>
<li><a href="#editfilesize-in-agent">5.2.14 <code>editfilesize</code></a>
<li><a href="#environment-in-agent">5.2.15 <code>environment</code></a>
<li><a href="#exclamation-in-agent">5.2.16 <code>exclamation</code></a>
<li><a href="#expireafter-in-agent">5.2.17 <code>expireafter</code></a>
<li><a href="#files_005fsingle_005fcopy-in-agent">5.2.18 <code>files_single_copy</code></a>
<li><a href="#files_005fauto_005fdefine-in-agent">5.2.19 <code>files_auto_define</code></a>
<li><a href="#fullencryption-in-agent">5.2.20 <code>fullencryption</code></a>
<li><a href="#hostnamekeys-in-agent">5.2.21 <code>hostnamekeys</code></a>
<li><a href="#ifelapsed-in-agent">5.2.22 <code>ifelapsed</code></a>
<li><a href="#inform-in-agent">5.2.23 <code>inform</code></a>
<li><a href="#lastseen-in-agent">5.2.24 <code>lastseen</code></a>
<li><a href="#intermittency-in-agent">5.2.25 <code>intermittency</code></a>
<li><a href="#max_005fchildren-in-agent">5.2.26 <code>max_children</code></a>
<li><a href="#maxconnections-in-agent">5.2.27 <code>maxconnections</code></a>
<li><a href="#mountfilesystems-in-agent">5.2.28 <code>mountfilesystems</code></a>
<li><a href="#nonalphanumfiles-in-agent">5.2.29 <code>nonalphanumfiles</code></a>
<li><a href="#repchar-in-agent">5.2.30 <code>repchar</code></a>
<li><a href="#default_005frepository-in-agent">5.2.31 <code>default_repository</code></a>
<li><a href="#secureinput-in-agent">5.2.32 <code>secureinput</code></a>
<li><a href="#sensiblecount-in-agent">5.2.33 <code>sensiblecount</code></a>
<li><a href="#sensiblesize-in-agent">5.2.34 <code>sensiblesize</code></a>
<li><a href="#skipidentify-in-agent">5.2.35 <code>skipidentify</code></a>
<li><a href="#suspiciousnames-in-agent">5.2.36 <code>suspiciousnames</code></a>
<li><a href="#syslog-in-agent">5.2.37 <code>syslog</code></a>
<li><a href="#timezone-in-agent">5.2.38 <code>timezone</code></a>
<li><a href="#default_005ftimeout-in-agent">5.2.39 <code>default_timeout</code></a>
<li><a href="#verbose-in-agent">5.2.40 <code>verbose</code></a>
</li></ul>
<li><a href="#control-server">5.3 <code>server</code> control promises</a>
<ul>
<li><a href="#cfruncommand-in-server">5.3.1 <code>cfruncommand</code></a>
<li><a href="#maxconnections-in-server">5.3.2 <code>maxconnections</code></a>
<li><a href="#denybadclocks-in-server">5.3.3 <code>denybadclocks</code></a>
<li><a href="#allowconnects-in-server">5.3.4 <code>allowconnects</code></a>
<li><a href="#denyconnects-in-server">5.3.5 <code>denyconnects</code></a>
<li><a href="#allowallconnects-in-server">5.3.6 <code>allowallconnects</code></a>
<li><a href="#trustkeysfrom-in-server">5.3.7 <code>trustkeysfrom</code></a>
<li><a href="#allowusers-in-server">5.3.8 <code>allowusers</code></a>
<li><a href="#dynamicaddresses-in-server">5.3.9 <code>dynamicaddresses</code></a>
<li><a href="#skipverify-in-server">5.3.10 <code>skipverify</code></a>
<li><a href="#logallconnections-in-server">5.3.11 <code>logallconnections</code></a>
<li><a href="#logencryptedtransfers-in-server">5.3.12 <code>logencryptedtransfers</code></a>
<li><a href="#hostnamekeys-in-server">5.3.13 <code>hostnamekeys</code></a>
<li><a href="#auditing-in-server">5.3.14 <code>auditing</code></a>
<li><a href="#bindtointerface-in-server">5.3.15 <code>bindtointerface</code></a>
<li><a href="#serverfacility-in-server">5.3.16 <code>serverfacility</code></a>
<li><a href="#port-in-server">5.3.17 <code>port</code></a>
</li></ul>
<li><a href="#control-monitor">5.4 <code>monitor</code> control promises</a>
<ul>
<li><a href="#forgetrate-in-monitor">5.4.1 <code>forgetrate</code></a>
<li><a href="#monitorfacility-in-monitor">5.4.2 <code>monitorfacility</code></a>
<li><a href="#histograms-in-monitor">5.4.3 <code>histograms</code></a>
<li><a href="#tcpdump-in-monitor">5.4.4 <code>tcpdump</code></a>
<li><a href="#tcpdumpcommand-in-monitor">5.4.5 <code>tcpdumpcommand</code></a>
</li></ul>
<li><a href="#control-runagent">5.5 <code>runagent</code> control promises</a>
<ul>
<li><a href="#hosts-in-runagent">5.5.1 <code>hosts</code></a>
<li><a href="#port-in-runagent">5.5.2 <code>port</code></a>
<li><a href="#force_005fipv4-in-runagent">5.5.3 <code>force_ipv4</code></a>
<li><a href="#trustkey-in-runagent">5.5.4 <code>trustkey</code></a>
<li><a href="#encrypt-in-runagent">5.5.5 <code>encrypt</code></a>
<li><a href="#background_005fchildren-in-runagent">5.5.6 <code>background_children</code></a>
<li><a href="#max_005fchildren-in-runagent">5.5.7 <code>max_children</code></a>
<li><a href="#output_005fto_005ffile-in-runagent">5.5.8 <code>output_to_file</code></a>
</li></ul>
<li><a href="#control-executor">5.6 <code>executor</code> control promises</a>
<ul>
<li><a href="#splaytime-in-executor">5.6.1 <code>splaytime</code></a>
<li><a href="#mailfrom-in-executor">5.6.2 <code>mailfrom</code></a>
<li><a href="#mailto-in-executor">5.6.3 <code>mailto</code></a>
<li><a href="#smtpserver-in-executor">5.6.4 <code>smtpserver</code></a>
<li><a href="#mailmaxlines-in-executor">5.6.5 <code>mailmaxlines</code></a>
<li><a href="#schedule-in-executor">5.6.6 <code>schedule</code></a>
<li><a href="#executorfacility-in-executor">5.6.7 <code>executorfacility</code></a>
<li><a href="#exec_005fcommand-in-executor">5.6.8 <code>exec_command</code></a>
</li></ul>
<li><a href="#control-knowledge">5.7 <code>knowledge</code> control promises</a>
<ul>
<li><a href="#id_005fprefix-in-knowledge">5.7.1 <code>id_prefix</code></a>
<li><a href="#build_005fdirectory-in-knowledge">5.7.2 <code>build_directory</code></a>
<li><a href="#sql_005ftype-in-knowledge">5.7.3 <code>sql_type</code></a>
<li><a href="#sql_005fdatabase-in-knowledge">5.7.4 <code>sql_database</code></a>
<li><a href="#sql_005fowner-in-knowledge">5.7.5 <code>sql_owner</code></a>
<li><a href="#sql_005fpasswd-in-knowledge">5.7.6 <code>sql_passwd</code></a>
<li><a href="#sql_005fserver-in-knowledge">5.7.7 <code>sql_server</code></a>
<li><a href="#sql_005fconnection_005fdb-in-knowledge">5.7.8 <code>sql_connection_db</code></a>
<li><a href="#query_005foutput-in-knowledge">5.7.9 <code>query_output</code></a>
<li><a href="#query_005fengine-in-knowledge">5.7.10 <code>query_engine</code></a>
<li><a href="#style_005fsheet-in-knowledge">5.7.11 <code>style_sheet</code></a>
<li><a href="#html_005fbanner-in-knowledge">5.7.12 <code>html_banner</code></a>
<li><a href="#html_005ffooter-in-knowledge">5.7.13 <code>html_footer</code></a>
<li><a href="#graph_005foutput-in-knowledge">5.7.14 <code>graph_output</code></a>
<li><a href="#graph_005fdirectory-in-knowledge">5.7.15 <code>graph_directory</code></a>
<li><a href="#generate_005fmanual-in-knowledge">5.7.16 <code>generate_manual</code></a>
<li><a href="#manual_005fsource_005fdirectory-in-knowledge">5.7.17 <code>manual_source_directory</code></a>
</li></ul>
<li><a href="#control-reporter">5.8 <code>reporter</code> control promises</a>
<ul>
<li><a href="#aggregation_005fpoint-in-reporter">5.8.1 <code>aggregation_point</code></a>
<li><a href="#auto_005fscaling-in-reporter">5.8.2 <code>auto_scaling</code></a>
<li><a href="#build_005fdirectory-in-reporter">5.8.3 <code>build_directory</code></a>
<li><a href="#csv2xml-in-reporter">5.8.4 <code>csv2xml</code></a>
<li><a href="#error_005fbars-in-reporter">5.8.5 <code>error_bars</code></a>
<li><a href="#html_005fbanner-in-reporter">5.8.6 <code>html_banner</code></a>
<li><a href="#html_005fembed-in-reporter">5.8.7 <code>html_embed</code></a>
<li><a href="#html_005ffooter-in-reporter">5.8.8 <code>html_footer</code></a>
<li><a href="#query_005fengine-in-reporter">5.8.9 <code>query_engine</code></a>
<li><a href="#reports-in-reporter">5.8.10 <code>reports</code></a>
<li><a href="#report_005foutput-in-reporter">5.8.11 <code>report_output</code></a>
<li><a href="#style_005fsheet-in-reporter">5.8.12 <code>style_sheet</code></a>
<li><a href="#time_005fstamps-in-reporter">5.8.13 <code>time_stamps</code></a>
</li></ul>
</li></ul>
<li><a name="toc_Bundles-for-common" href="#Bundles-for-common">6 Bundles of <code>common</code></a>
<ul>
<li><a href="#vars-in-common-promises">6.1 <code>vars</code> promises</a>
<ul>
<li><a href="#string-in-vars">6.1.1 <code>string</code></a>
<li><a href="#int-in-vars">6.1.2 <code>int</code></a>
<li><a href="#real-in-vars">6.1.3 <code>real</code></a>
<li><a href="#slist-in-vars">6.1.4 <code>slist</code></a>
<li><a href="#ilist-in-vars">6.1.5 <code>ilist</code></a>
<li><a href="#rlist-in-vars">6.1.6 <code>rlist</code></a>
<li><a href="#policy-in-vars">6.1.7 <code>policy</code></a>
</li></ul>
<li><a href="#classes-in-common-promises">6.2 <code>classes</code> promises</a>
<ul>
<li><a href="#or-in-classes">6.2.1 <code>or</code></a>
<li><a href="#and-in-classes">6.2.2 <code>and</code></a>
<li><a href="#xor-in-classes">6.2.3 <code>xor</code></a>
<li><a href="#dist-in-classes">6.2.4 <code>dist</code></a>
<li><a href="#expression-in-classes">6.2.5 <code>expression</code></a>
<li><a href="#not-in-classes">6.2.6 <code>not</code></a>
</li></ul>
<li><a href="#reports-in-common-promises">6.3 <code>reports</code> promises</a>
<ul>
<li><a href="#friend_005fpattern-in-reports">6.3.1 <code>friend_pattern</code></a>
<li><a href="#intermittency-in-reports">6.3.2 <code>intermittency</code></a>
<li><a href="#lastseen-in-reports">6.3.3 <code>lastseen</code></a>
<li><a href="#printfile-in-reports">6.3.4 <code>printfile</code> (compound body)</a>
<li><a href="#report_005fto_005ffile-in-reports">6.3.5 <code>report_to_file</code></a>
<li><a href="#showstate-in-reports">6.3.6 <code>showstate</code></a>
</li></ul>
<li><a href="#_002a-in-agent-promises">6.4 <code>*</code> promises in &lsquo;<samp><span class="samp">agent</span></samp>&rsquo;</a>
<ul>
<li><a href="#action-in-_002a">6.4.1 <code>action</code> (compound body)</a>
<li><a href="#classes-in-_002a">6.4.2 <code>classes</code> (compound body)</a>
<li><a href="#ifvarclass-in-_002a">6.4.3 <code>ifvarclass</code></a>
<li><a href="#handle-in-_002a">6.4.4 <code>handle</code></a>
<li><a href="#depends_005fon-in-_002a">6.4.5 <code>depends_on</code></a>
<li><a href="#comment-in-_002a">6.4.6 <code>comment</code></a>
</li></ul>
<li><a href="#_002a-in-edit_005fline-promises">6.5 <code>*</code> promises in &lsquo;<samp><span class="samp">edit_line</span></samp>&rsquo;</a>
<ul>
<li><a href="#select_005fregion-in-_002a">6.5.1 <code>select_region</code> (compound body)</a>
</li></ul>
</li></ul>
<li><a name="toc_Bundles-for-agent" href="#Bundles-for-agent">7 Bundles of <code>agent</code></a>
<ul>
<li><a href="#commands-in-agent-promises">7.1 <code>commands</code> promises in &lsquo;<samp><span class="samp">agent</span></samp>&rsquo;</a>
<ul>
<li><a href="#args-in-commands">7.1.1 <code>args</code></a>
<li><a href="#contain-in-commands">7.1.2 <code>contain</code> (compound body)</a>
<li><a href="#module-in-commands">7.1.3 <code>module</code></a>
</li></ul>
<li><a href="#databases-in-agent-promises">7.2 <code>databases</code> promises in &lsquo;<samp><span class="samp">agent</span></samp>&rsquo;</a>
<ul>
<li><a href="#database_005fserver-in-databases">7.2.1 <code>database_server</code> (compound body)</a>
<li><a href="#database_005ftype-in-databases">7.2.2 <code>database_type</code></a>
<li><a href="#database_005foperation-in-databases">7.2.3 <code>database_operation</code></a>
<li><a href="#database_005fcolumns-in-databases">7.2.4 <code>database_columns</code></a>
<li><a href="#database_005frows-in-databases">7.2.5 <code>database_rows</code></a>
<li><a href="#registry_005fexclude-in-databases">7.2.6 <code>registry_exclude</code></a>
</li></ul>
<li><a href="#files-in-agent-promises">7.3 <code>files</code> promises in &lsquo;<samp><span class="samp">agent</span></samp>&rsquo;</a>
<ul>
<li><a href="#acl-in-files">7.3.1 <code>acl</code> (compound body)</a>
<li><a href="#changes-in-files">7.3.2 <code>changes</code> (compound body)</a>
<li><a href="#copy_005ffrom-in-files">7.3.3 <code>copy_from</code> (compound body)</a>
<li><a href="#create-in-files">7.3.4 <code>create</code></a>
<li><a href="#delete-in-files">7.3.5 <code>delete</code> (compound body)</a>
<li><a href="#depth_005fsearch-in-files">7.3.6 <code>depth_search</code> (compound body)</a>
<li><a href="#edit_005fline-in-files">7.3.7 <code>edit_line</code></a>
<li><a href="#edit_005fxml-in-files">7.3.8 <code>edit_xml</code></a>
<li><a href="#edit_005fdefaults-in-files">7.3.9 <code>edit_defaults</code> (compound body)</a>
<li><a href="#file_005fselect-in-files">7.3.10 <code>file_select</code> (compound body)</a>
<li><a href="#link_005ffrom-in-files">7.3.11 <code>link_from</code> (compound body)</a>
<li><a href="#move_005fobstructions-in-files">7.3.12 <code>move_obstructions</code></a>
<li><a href="#pathtype-in-files">7.3.13 <code>pathtype</code></a>
<li><a href="#perms-in-files">7.3.14 <code>perms</code> (compound body)</a>
<li><a href="#rename-in-files">7.3.15 <code>rename</code> (compound body)</a>
<li><a href="#repository-in-files">7.3.16 <code>repository</code></a>
<li><a href="#touch-in-files">7.3.17 <code>touch</code></a>
<li><a href="#transformer-in-files">7.3.18 <code>transformer</code></a>
</li></ul>
<li><a href="#delete_005flines-in-edit_005fline-promises">7.4 <code>delete_lines</code> promises in &lsquo;<samp><span class="samp">edit_line</span></samp>&rsquo;</a>
<ul>
<li><a href="#delete_005fselect-in-delete_005flines">7.4.1 <code>delete_select</code> (compound body)</a>
<li><a href="#not_005fmatching-in-delete_005flines">7.4.2 <code>not_matching</code></a>
</li></ul>
<li><a href="#insert_005flines-in-edit_005fline-promises">7.5 <code>insert_lines</code> promises in &lsquo;<samp><span class="samp">edit_line</span></samp>&rsquo;</a>
<ul>
<li><a href="#expand_005fscalars-in-insert_005flines">7.5.1 <code>expand_scalars</code></a>
<li><a href="#insert_005ftype-in-insert_005flines">7.5.2 <code>insert_type</code></a>
<li><a href="#insert_005fselect-in-insert_005flines">7.5.3 <code>insert_select</code> (compound body)</a>
<li><a href="#location-in-insert_005flines">7.5.4 <code>location</code> (compound body)</a>
</li></ul>
<li><a href="#field_005fedits-in-edit_005fline-promises">7.6 <code>field_edits</code> promises in &lsquo;<samp><span class="samp">edit_line</span></samp>&rsquo;</a>
<ul>
<li><a href="#edit_005ffield-in-field_005fedits">7.6.1 <code>edit_field</code> (compound body)</a>
</li></ul>
<li><a href="#replace_005fpatterns-in-edit_005fline-promises">7.7 <code>replace_patterns</code> promises in &lsquo;<samp><span class="samp">edit_line</span></samp>&rsquo;</a>
<ul>
<li><a href="#replace_005fwith-in-replace_005fpatterns">7.7.1 <code>replace_with</code> (compound body)</a>
</li></ul>
<li><a href="#interfaces-in-agent-promises">7.8 <code>interfaces</code> promises in &lsquo;<samp><span class="samp">agent</span></samp>&rsquo;</a>
<ul>
<li><a href="#tcp_005fip-in-interfaces">7.8.1 <code>tcp_ip</code> (compound body)</a>
</li></ul>
<li><a href="#methods-in-agent-promises">7.9 <code>methods</code> promises in &lsquo;<samp><span class="samp">agent</span></samp>&rsquo;</a>
<ul>
<li><a href="#usebundle-in-methods">7.9.1 <code>usebundle</code></a>
</li></ul>
<li><a href="#packages-in-agent-promises">7.10 <code>packages</code> promises in &lsquo;<samp><span class="samp">agent</span></samp>&rsquo;</a>
<ul>
<li><a href="#package_005farchitectures-in-packages">7.10.1 <code>package_architectures</code></a>
<li><a href="#package_005fmethod-in-packages">7.10.2 <code>package_method</code> (compound body)</a>
<li><a href="#package_005fpolicy-in-packages">7.10.3 <code>package_policy</code></a>
<li><a href="#package_005fselect-in-packages">7.10.4 <code>package_select</code></a>
<li><a href="#package_005fversion-in-packages">7.10.5 <code>package_version</code></a>
</li></ul>
<li><a href="#processes-in-agent-promises">7.11 <code>processes</code> promises in &lsquo;<samp><span class="samp">agent</span></samp>&rsquo;</a>
<ul>
<li><a href="#process_005fcount-in-processes">7.11.1 <code>process_count</code> (compound body)</a>
<li><a href="#process_005fselect-in-processes">7.11.2 <code>process_select</code> (compound body)</a>
<li><a href="#process_005fstop-in-processes">7.11.3 <code>process_stop</code></a>
<li><a href="#restart_005fclass-in-processes">7.11.4 <code>restart_class</code></a>
<li><a href="#signals-in-processes">7.11.5 <code>signals</code></a>
</li></ul>
<li><a href="#storage-in-agent-promises">7.12 <code>storage</code> promises in &lsquo;<samp><span class="samp">agent</span></samp>&rsquo;</a>
<ul>
<li><a href="#mount-in-storage">7.12.1 <code>mount</code> (compound body)</a>
<li><a href="#volume-in-storage">7.12.2 <code>volume</code> (compound body)</a>
</li></ul>
</li></ul>
<li><a name="toc_Bundles-for-server" href="#Bundles-for-server">8 Bundles of <code>server</code></a>
<ul>
<li><a href="#access-in-server-promises">8.1 <code>access</code> promises in &lsquo;<samp><span class="samp">server</span></samp>&rsquo;</a>
<ul>
<li><a href="#Access-Example">8.1.1 Access Example</a>
<li><a href="#admit-in-access">8.1.2 <code>admit</code></a>
<li><a href="#deny-in-access">8.1.3 <code>deny</code></a>
<li><a href="#maproot-in-access">8.1.4 <code>maproot</code></a>
<li><a href="#ifencrypted-in-access">8.1.5 <code>ifencrypted</code></a>
<li><a href="#resource_005ftype-in-access">8.1.6 <code>resource_type</code></a>
</li></ul>
<li><a href="#roles-in-server-promises">8.2 <code>roles</code> promises in &lsquo;<samp><span class="samp">server</span></samp>&rsquo;</a>
<ul>
<li><a href="#authorize-in-roles">8.2.1 <code>authorize</code></a>
</li></ul>
</li></ul>
<li><a name="toc_Bundles-for-knowledge" href="#Bundles-for-knowledge">9 Bundles of <code>knowledge</code></a>
<ul>
<li><a href="#topics-in-knowledge-promises">9.1 <code>topics</code> promises in &lsquo;<samp><span class="samp">knowledge</span></samp>&rsquo;</a>
<ul>
<li><a href="#association-in-topics">9.1.1 <code>association</code> (compound body)</a>
<li><a href="#comment-in-topics">9.1.2 <code>comment</code></a>
</li></ul>
<li><a href="#occurrences-in-knowledge-promises">9.2 <code>occurrences</code> promises in &lsquo;<samp><span class="samp">knowledge</span></samp>&rsquo;</a>
<ul>
<li><a href="#represents-in-occurrences">9.2.1 <code>represents</code></a>
<li><a href="#representation-in-occurrences">9.2.2 <code>representation</code></a>
<li><a href="#web_005froot-in-occurrences">9.2.3 <code>web_root</code></a>
<li><a href="#path_005froot-in-occurrences">9.2.4 <code>path_root</code></a>
</li></ul>
</li></ul>
<li><a name="toc_Bundles-for-monitor" href="#Bundles-for-monitor">10 Bundles of <code>monitor</code></a>
<ul>
<li><a href="#measurements-in-monitor-promises">10.1 <code>measurements</code> promises in &lsquo;<samp><span class="samp">monitor</span></samp>&rsquo;</a>
<ul>
<li><a href="#stream_005ftype-in-measurements">10.1.1 <code>stream_type</code></a>
<li><a href="#data_005ftype-in-measurements">10.1.2 <code>data_type</code></a>
<li><a href="#history_005ftype-in-measurements">10.1.3 <code>history_type</code></a>
<li><a href="#units-in-measurements">10.1.4 <code>units</code></a>
<li><a href="#match_005fvalue-in-measurements">10.1.5 <code>match_value</code> (compound body)</a>
</li></ul>
</li></ul>
<li><a name="toc_Special-functions" href="#Special-functions">11 Special functions</a>
<ul>
<li><a href="#Function-accessedbefore">11.1 Function accessedbefore</a>
<li><a href="#Function-accumulated">11.2 Function accumulated</a>
<li><a href="#Function-ago">11.3 Function ago</a>
<li><a href="#Function-canonify">11.4 Function canonify</a>
<li><a href="#Function-changedbefore">11.5 Function changedbefore</a>
<li><a href="#Function-classify">11.6 Function classify</a>
<li><a href="#Function-classmatch">11.7 Function classmatch</a>
<li><a href="#Function-execresult">11.8 Function execresult</a>
<li><a href="#Function-fileexists">11.9 Function fileexists</a>
<li><a href="#Function-filesexist">11.10 Function filesexist</a>
<li><a href="#Function-getindices">11.11 Function getindices</a>
<li><a href="#Function-getgid">11.12 Function getgid</a>
<li><a href="#Function-getuid">11.13 Function getuid</a>
<li><a href="#Function-groupexists">11.14 Function groupexists</a>
<li><a href="#Function-hash">11.15 Function hash</a>
<li><a href="#Function-hashmatch">11.16 Function hashmatch</a>
<li><a href="#Function-hostrange">11.17 Function hostrange</a>
<li><a href="#Function-hostinnetgroup">11.18 Function hostinnetgroup</a>
<li><a href="#Function-iprange">11.19 Function iprange</a>
<li><a href="#Function-irange">11.20 Function irange</a>
<li><a href="#Function-isdir">11.21 Function isdir</a>
<li><a href="#Function-isgreaterthan">11.22 Function isgreaterthan</a>
<li><a href="#Function-islessthan">11.23 Function islessthan</a>
<li><a href="#Function-islink">11.24 Function islink</a>
<li><a href="#Function-isnewerthan">11.25 Function isnewerthan</a>
<li><a href="#Function-isplain">11.26 Function isplain</a>
<li><a href="#Function-isvariable">11.27 Function isvariable</a>
<li><a href="#Function-lastnode">11.28 Function lastnode</a>
<li><a href="#Function-ldaparray">11.29 Function ldaparray</a>
<li><a href="#Function-ldaplist">11.30 Function ldaplist</a>
<li><a href="#Function-ldapvalue">11.31 Function ldapvalue</a>
<li><a href="#Function-now">11.32 Function now</a>
<li><a href="#Function-on">11.33 Function on</a>
<li><a href="#Function-peers">11.34 Function peers</a>
<li><a href="#Function-peerleader">11.35 Function peerleader</a>
<li><a href="#Function-peerleaders">11.36 Function peerleaders</a>
<li><a href="#Function-randomint">11.37 Function randomint</a>
<li><a href="#Function-readfile">11.38 Function readfile</a>
<li><a href="#Function-readintarray">11.39 Function readintarray</a>
<li><a href="#Function-readintlist">11.40 Function readintlist</a>
<li><a href="#Function-readrealarray">11.41 Function readrealarray</a>
<li><a href="#Function-readreallist">11.42 Function readreallist</a>
<li><a href="#Function-readstringarray">11.43 Function readstringarray</a>
<li><a href="#Function-readstringlist">11.44 Function readstringlist</a>
<li><a href="#Function-readtcp">11.45 Function readtcp</a>
<li><a href="#Function-regarray">11.46 Function regarray</a>
<li><a href="#Function-regcmp">11.47 Function regcmp</a>
<li><a href="#Function-registryvalue">11.48 Function registryvalue</a>
<li><a href="#Function-regline">11.49 Function regline</a>
<li><a href="#Function-reglist">11.50 Function reglist</a>
<li><a href="#Function-regldap">11.51 Function regldap</a>
<li><a href="#Function-remotescalar">11.52 Function remotescalar</a>
<li><a href="#Function-returnszero">11.53 Function returnszero</a>
<li><a href="#Function-rrange">11.54 Function rrange</a>
<li><a href="#Function-selectservers">11.55 Function selectservers</a>
<li><a href="#Function-splayclass">11.56 Function splayclass</a>
<li><a href="#Function-splitstring">11.57 Function splitstring</a>
<li><a href="#Function-strcmp">11.58 Function strcmp</a>
<li><a href="#Function-usemodule">11.59 Function usemodule</a>
<li><a href="#Function-userexists">11.60 Function userexists</a>
</li></ul>
<li><a name="toc_Special-Variables" href="#Special-Variables">12 Special Variables</a>
<ul>
<li><a href="#Variable-context-const">12.1 Variable context <code>const</code></a>
<ul>
<li><a href="#Variable-const_002edollar">12.1.1 Variable const.dollar</a>
<li><a href="#Variable-const_002eendl">12.1.2 Variable const.endl</a>
<li><a href="#Variable-const_002en">12.1.3 Variable const.n</a>
<li><a href="#Variable-const_002er">12.1.4 Variable const.r</a>
</li></ul>
<li><a href="#Variable-context-sys">12.2 Variable context <code>sys</code></a>
<ul>
<li><a href="#Variable-sys_002earch">12.2.1 Variable sys.arch</a>
<li><a href="#Variable-sys_002ecdate">12.2.2 Variable sys.cdate</a>
<li><a href="#Variable-sys_002eclass">12.2.3 Variable sys.class</a>
<li><a href="#Variable-sys_002edate">12.2.4 Variable sys.date</a>
<li><a href="#Variable-sys_002edomain">12.2.5 Variable sys.domain</a>
<li><a href="#Variable-sys_002efqhost">12.2.6 Variable sys.fqhost</a>
<li><a href="#Variable-sys_002efstab">12.2.7 Variable sys.fstab</a>
<li><a href="#Variable-sys_002ehost">12.2.8 Variable sys.host</a>
<li><a href="#Variable-sys_002elong_005farch">12.2.9 Variable sys.long_arch</a>
<li><a href="#Variable-sys_002emaildir">12.2.10 Variable sys.maildir</a>
<li><a href="#Variable-sys_002eos">12.2.11 Variable sys.os</a>
<li><a href="#Variable-sys_002eostype">12.2.12 Variable sys.ostype</a>
<li><a href="#Variable-sys_002erelease">12.2.13 Variable sys.release</a>
<li><a href="#Variable-sys_002eresolv">12.2.14 Variable sys.resolv</a>
<li><a href="#Variable-sys_002euqhost">12.2.15 Variable sys.uqhost</a>
<li><a href="#Variable-sys_002eworkdir">12.2.16 Variable sys.workdir</a>
</li></ul>
<li><a href="#Variable-context-mon">12.3 Variable context <code>mon</code></a>
<ul>
<li><a href="#Variable-mon_002evalue_005fusers">12.3.1 Variable mon.value_users</a>
<li><a href="#Variable-mon_002eaverage_005fusers">12.3.2 Variable mon.average_users</a>
<li><a href="#Variable-mon_002estddev_005fusers">12.3.3 Variable mon.stddev_users</a>
<li><a href="#Variable-mon_002evalue_005frootprocs">12.3.4 Variable mon.value_rootprocs</a>
<li><a href="#Variable-mon_002eaverage_005frootprocs">12.3.5 Variable mon.average_rootprocs</a>
<li><a href="#Variable-mon_002estddev_005frootprocs">12.3.6 Variable mon.stddev_rootprocs</a>
<li><a href="#Variable-mon_002evalue_005fotherprocs">12.3.7 Variable mon.value_otherprocs</a>
<li><a href="#Variable-mon_002eaverage_005fotherprocs">12.3.8 Variable mon.average_otherprocs</a>
<li><a href="#Variable-mon_002estddev_005fotherprocs">12.3.9 Variable mon.stddev_otherprocs</a>
<li><a href="#Variable-mon_002evalue_005fdiskfree">12.3.10 Variable mon.value_diskfree</a>
<li><a href="#Variable-mon_002eaverage_005fdiskfree">12.3.11 Variable mon.average_diskfree</a>
<li><a href="#Variable-mon_002estddev_005fdiskfree">12.3.12 Variable mon.stddev_diskfree</a>
<li><a href="#Variable-mon_002evalue_005floadavg">12.3.13 Variable mon.value_loadavg</a>
<li><a href="#Variable-mon_002eaverage_005floadavg">12.3.14 Variable mon.average_loadavg</a>
<li><a href="#Variable-mon_002estddev_005floadavg">12.3.15 Variable mon.stddev_loadavg</a>
<li><a href="#Variable-mon_002evalue_005fnetbiosns_005fin">12.3.16 Variable mon.value_netbiosns_in</a>
<li><a href="#Variable-mon_002eaverage_005fnetbiosns_005fin">12.3.17 Variable mon.average_netbiosns_in</a>
<li><a href="#Variable-mon_002estddev_005fnetbiosns_005fin">12.3.18 Variable mon.stddev_netbiosns_in</a>
<li><a href="#Variable-mon_002evalue_005fnetbiosns_005fout">12.3.19 Variable mon.value_netbiosns_out</a>
<li><a href="#Variable-mon_002eaverage_005fnetbiosns_005fout">12.3.20 Variable mon.average_netbiosns_out</a>
<li><a href="#Variable-mon_002estddev_005fnetbiosns_005fout">12.3.21 Variable mon.stddev_netbiosns_out</a>
<li><a href="#Variable-mon_002evalue_005fnetbiosdgm_005fin">12.3.22 Variable mon.value_netbiosdgm_in</a>
<li><a href="#Variable-mon_002eaverage_005fnetbiosdgm_005fin">12.3.23 Variable mon.average_netbiosdgm_in</a>
<li><a href="#Variable-mon_002estddev_005fnetbiosdgm_005fin">12.3.24 Variable mon.stddev_netbiosdgm_in</a>
<li><a href="#Variable-mon_002evalue_005fnetbiosdgm_005fout">12.3.25 Variable mon.value_netbiosdgm_out</a>
<li><a href="#Variable-mon_002eaverage_005fnetbiosdgm_005fout">12.3.26 Variable mon.average_netbiosdgm_out</a>
<li><a href="#Variable-mon_002estddev_005fnetbiosdgm_005fout">12.3.27 Variable mon.stddev_netbiosdgm_out</a>
<li><a href="#Variable-mon_002evalue_005fnetbiosssn_005fin">12.3.28 Variable mon.value_netbiosssn_in</a>
<li><a href="#Variable-mon_002eaverage_005fnetbiosssn_005fin">12.3.29 Variable mon.average_netbiosssn_in</a>
<li><a href="#Variable-mon_002estddev_005fnetbiosssn_005fin">12.3.30 Variable mon.stddev_netbiosssn_in</a>
<li><a href="#Variable-mon_002evalue_005fnetbiosssn_005fout">12.3.31 Variable mon.value_netbiosssn_out</a>
<li><a href="#Variable-mon_002eaverage_005fnetbiosssn_005fout">12.3.32 Variable mon.average_netbiosssn_out</a>
<li><a href="#Variable-mon_002estddev_005fnetbiosssn_005fout">12.3.33 Variable mon.stddev_netbiosssn_out</a>
<li><a href="#Variable-mon_002evalue_005firc_005fin">12.3.34 Variable mon.value_irc_in</a>
<li><a href="#Variable-mon_002eaverage_005firc_005fin">12.3.35 Variable mon.average_irc_in</a>
<li><a href="#Variable-mon_002estddev_005firc_005fin">12.3.36 Variable mon.stddev_irc_in</a>
<li><a href="#Variable-mon_002evalue_005firc_005fout">12.3.37 Variable mon.value_irc_out</a>
<li><a href="#Variable-mon_002eaverage_005firc_005fout">12.3.38 Variable mon.average_irc_out</a>
<li><a href="#Variable-mon_002estddev_005firc_005fout">12.3.39 Variable mon.stddev_irc_out</a>
<li><a href="#Variable-mon_002evalue_005fcfengine_005fin">12.3.40 Variable mon.value_cfengine_in</a>
<li><a href="#Variable-mon_002eaverage_005fcfengine_005fin">12.3.41 Variable mon.average_cfengine_in</a>
<li><a href="#Variable-mon_002estddev_005fcfengine_005fin">12.3.42 Variable mon.stddev_cfengine_in</a>
<li><a href="#Variable-mon_002evalue_005fcfengine_005fout">12.3.43 Variable mon.value_cfengine_out</a>
<li><a href="#Variable-mon_002eaverage_005fcfengine_005fout">12.3.44 Variable mon.average_cfengine_out</a>
<li><a href="#Variable-mon_002estddev_005fcfengine_005fout">12.3.45 Variable mon.stddev_cfengine_out</a>
<li><a href="#Variable-mon_002evalue_005fnfsd_005fin">12.3.46 Variable mon.value_nfsd_in</a>
<li><a href="#Variable-mon_002eaverage_005fnfsd_005fin">12.3.47 Variable mon.average_nfsd_in</a>
<li><a href="#Variable-mon_002estddev_005fnfsd_005fin">12.3.48 Variable mon.stddev_nfsd_in</a>
<li><a href="#Variable-mon_002evalue_005fnfsd_005fout">12.3.49 Variable mon.value_nfsd_out</a>
<li><a href="#Variable-mon_002eaverage_005fnfsd_005fout">12.3.50 Variable mon.average_nfsd_out</a>
<li><a href="#Variable-mon_002estddev_005fnfsd_005fout">12.3.51 Variable mon.stddev_nfsd_out</a>
<li><a href="#Variable-mon_002evalue_005fsmtp_005fin">12.3.52 Variable mon.value_smtp_in</a>
<li><a href="#Variable-mon_002eaverage_005fsmtp_005fin">12.3.53 Variable mon.average_smtp_in</a>
<li><a href="#Variable-mon_002estddev_005fsmtp_005fin">12.3.54 Variable mon.stddev_smtp_in</a>
<li><a href="#Variable-mon_002evalue_005fsmtp_005fout">12.3.55 Variable mon.value_smtp_out</a>
<li><a href="#Variable-mon_002eaverage_005fsmtp_005fout">12.3.56 Variable mon.average_smtp_out</a>
<li><a href="#Variable-mon_002estddev_005fsmtp_005fout">12.3.57 Variable mon.stddev_smtp_out</a>
<li><a href="#Variable-mon_002evalue_005fwww_005fin">12.3.58 Variable mon.value_www_in</a>
<li><a href="#Variable-mon_002eaverage_005fwww_005fin">12.3.59 Variable mon.average_www_in</a>
<li><a href="#Variable-mon_002estddev_005fwww_005fin">12.3.60 Variable mon.stddev_www_in</a>
<li><a href="#Variable-mon_002evalue_005fwww_005fout">12.3.61 Variable mon.value_www_out</a>
<li><a href="#Variable-mon_002eaverage_005fwww_005fout">12.3.62 Variable mon.average_www_out</a>
<li><a href="#Variable-mon_002estddev_005fwww_005fout">12.3.63 Variable mon.stddev_www_out</a>
<li><a href="#Variable-mon_002evalue_005fftp_005fin">12.3.64 Variable mon.value_ftp_in</a>
<li><a href="#Variable-mon_002eaverage_005fftp_005fin">12.3.65 Variable mon.average_ftp_in</a>
<li><a href="#Variable-mon_002estddev_005fftp_005fin">12.3.66 Variable mon.stddev_ftp_in</a>
<li><a href="#Variable-mon_002evalue_005fftp_005fout">12.3.67 Variable mon.value_ftp_out</a>
<li><a href="#Variable-mon_002eaverage_005fftp_005fout">12.3.68 Variable mon.average_ftp_out</a>
<li><a href="#Variable-mon_002estddev_005fftp_005fout">12.3.69 Variable mon.stddev_ftp_out</a>
<li><a href="#Variable-mon_002evalue_005fssh_005fin">12.3.70 Variable mon.value_ssh_in</a>
<li><a href="#Variable-mon_002eaverage_005fssh_005fin">12.3.71 Variable mon.average_ssh_in</a>
<li><a href="#Variable-mon_002estddev_005fssh_005fin">12.3.72 Variable mon.stddev_ssh_in</a>
<li><a href="#Variable-mon_002evalue_005fssh_005fout">12.3.73 Variable mon.value_ssh_out</a>
<li><a href="#Variable-mon_002eaverage_005fssh_005fout">12.3.74 Variable mon.average_ssh_out</a>
<li><a href="#Variable-mon_002estddev_005fssh_005fout">12.3.75 Variable mon.stddev_ssh_out</a>
<li><a href="#Variable-mon_002evalue_005fwwws_005fin">12.3.76 Variable mon.value_wwws_in</a>
<li><a href="#Variable-mon_002eaverage_005fwwws_005fin">12.3.77 Variable mon.average_wwws_in</a>
<li><a href="#Variable-mon_002estddev_005fwwws_005fin">12.3.78 Variable mon.stddev_wwws_in</a>
<li><a href="#Variable-mon_002evalue_005fwwws_005fout">12.3.79 Variable mon.value_wwws_out</a>
<li><a href="#Variable-mon_002eaverage_005fwwws_005fout">12.3.80 Variable mon.average_wwws_out</a>
<li><a href="#Variable-mon_002estddev_005fwwws_005fout">12.3.81 Variable mon.stddev_wwws_out</a>
<li><a href="#Variable-mon_002evalue_005ficmp_005fin">12.3.82 Variable mon.value_icmp_in</a>
<li><a href="#Variable-mon_002eaverage_005ficmp_005fin">12.3.83 Variable mon.average_icmp_in</a>
<li><a href="#Variable-mon_002estddev_005ficmp_005fin">12.3.84 Variable mon.stddev_icmp_in</a>
<li><a href="#Variable-mon_002evalue_005ficmp_005fout">12.3.85 Variable mon.value_icmp_out</a>
<li><a href="#Variable-mon_002eaverage_005ficmp_005fout">12.3.86 Variable mon.average_icmp_out</a>
<li><a href="#Variable-mon_002estddev_005ficmp_005fout">12.3.87 Variable mon.stddev_icmp_out</a>
<li><a href="#Variable-mon_002evalue_005fudp_005fin">12.3.88 Variable mon.value_udp_in</a>
<li><a href="#Variable-mon_002eaverage_005fudp_005fin">12.3.89 Variable mon.average_udp_in</a>
<li><a href="#Variable-mon_002estddev_005fudp_005fin">12.3.90 Variable mon.stddev_udp_in</a>
<li><a href="#Variable-mon_002evalue_005fudp_005fout">12.3.91 Variable mon.value_udp_out</a>
<li><a href="#Variable-mon_002eaverage_005fudp_005fout">12.3.92 Variable mon.average_udp_out</a>
<li><a href="#Variable-mon_002estddev_005fudp_005fout">12.3.93 Variable mon.stddev_udp_out</a>
<li><a href="#Variable-mon_002evalue_005fdns_005fin">12.3.94 Variable mon.value_dns_in</a>
<li><a href="#Variable-mon_002eaverage_005fdns_005fin">12.3.95 Variable mon.average_dns_in</a>
<li><a href="#Variable-mon_002estddev_005fdns_005fin">12.3.96 Variable mon.stddev_dns_in</a>
<li><a href="#Variable-mon_002evalue_005fdns_005fout">12.3.97 Variable mon.value_dns_out</a>
<li><a href="#Variable-mon_002eaverage_005fdns_005fout">12.3.98 Variable mon.average_dns_out</a>
<li><a href="#Variable-mon_002estddev_005fdns_005fout">12.3.99 Variable mon.stddev_dns_out</a>
<li><a href="#Variable-mon_002evalue_005ftcpsyn_005fin">12.3.100 Variable mon.value_tcpsyn_in</a>
<li><a href="#Variable-mon_002eaverage_005ftcpsyn_005fin">12.3.101 Variable mon.average_tcpsyn_in</a>
<li><a href="#Variable-mon_002estddev_005ftcpsyn_005fin">12.3.102 Variable mon.stddev_tcpsyn_in</a>
<li><a href="#Variable-mon_002evalue_005ftcpsyn_005fout">12.3.103 Variable mon.value_tcpsyn_out</a>
<li><a href="#Variable-mon_002eaverage_005ftcpsyn_005fout">12.3.104 Variable mon.average_tcpsyn_out</a>
<li><a href="#Variable-mon_002estddev_005ftcpsyn_005fout">12.3.105 Variable mon.stddev_tcpsyn_out</a>
<li><a href="#Variable-mon_002evalue_005ftcpack_005fin">12.3.106 Variable mon.value_tcpack_in</a>
<li><a href="#Variable-mon_002eaverage_005ftcpack_005fin">12.3.107 Variable mon.average_tcpack_in</a>
<li><a href="#Variable-mon_002estddev_005ftcpack_005fin">12.3.108 Variable mon.stddev_tcpack_in</a>
<li><a href="#Variable-mon_002evalue_005ftcpack_005fout">12.3.109 Variable mon.value_tcpack_out</a>
<li><a href="#Variable-mon_002eaverage_005ftcpack_005fout">12.3.110 Variable mon.average_tcpack_out</a>
<li><a href="#Variable-mon_002estddev_005ftcpack_005fout">12.3.111 Variable mon.stddev_tcpack_out</a>
<li><a href="#Variable-mon_002evalue_005ftcpfin_005fin">12.3.112 Variable mon.value_tcpfin_in</a>
<li><a href="#Variable-mon_002eaverage_005ftcpfin_005fin">12.3.113 Variable mon.average_tcpfin_in</a>
<li><a href="#Variable-mon_002estddev_005ftcpfin_005fin">12.3.114 Variable mon.stddev_tcpfin_in</a>
<li><a href="#Variable-mon_002evalue_005ftcpfin_005fout">12.3.115 Variable mon.value_tcpfin_out</a>
<li><a href="#Variable-mon_002eaverage_005ftcpfin_005fout">12.3.116 Variable mon.average_tcpfin_out</a>
<li><a href="#Variable-mon_002estddev_005ftcpfin_005fout">12.3.117 Variable mon.stddev_tcpfin_out</a>
<li><a href="#Variable-mon_002evalue_005ftcpmisc_005fin">12.3.118 Variable mon.value_tcpmisc_in</a>
<li><a href="#Variable-mon_002eaverage_005ftcpmisc_005fin">12.3.119 Variable mon.average_tcpmisc_in</a>
<li><a href="#Variable-mon_002estddev_005ftcpmisc_005fin">12.3.120 Variable mon.stddev_tcpmisc_in</a>
<li><a href="#Variable-mon_002evalue_005ftcpmisc_005fout">12.3.121 Variable mon.value_tcpmisc_out</a>
<li><a href="#Variable-mon_002eaverage_005ftcpmisc_005fout">12.3.122 Variable mon.average_tcpmisc_out</a>
<li><a href="#Variable-mon_002estddev_005ftcpmisc_005fout">12.3.123 Variable mon.stddev_tcpmisc_out</a>
<li><a href="#Variable-mon_002evalue_005fwebaccess">12.3.124 Variable mon.value_webaccess</a>
<li><a href="#Variable-mon_002eaverage_005fwebaccess">12.3.125 Variable mon.average_webaccess</a>
<li><a href="#Variable-mon_002estddev_005fwebaccess">12.3.126 Variable mon.stddev_webaccess</a>
<li><a href="#Variable-mon_002evalue_005fweberrors">12.3.127 Variable mon.value_weberrors</a>
<li><a href="#Variable-mon_002eaverage_005fweberrors">12.3.128 Variable mon.average_weberrors</a>
<li><a href="#Variable-mon_002estddev_005fweberrors">12.3.129 Variable mon.stddev_weberrors</a>
<li><a href="#Variable-mon_002evalue_005fsyslog">12.3.130 Variable mon.value_syslog</a>
<li><a href="#Variable-mon_002eaverage_005fsyslog">12.3.131 Variable mon.average_syslog</a>
<li><a href="#Variable-mon_002estddev_005fsyslog">12.3.132 Variable mon.stddev_syslog</a>
<li><a href="#Variable-mon_002evalue_005fmessages">12.3.133 Variable mon.value_messages</a>
<li><a href="#Variable-mon_002eaverage_005fmessages">12.3.134 Variable mon.average_messages</a>
<li><a href="#Variable-mon_002estddev_005fmessages">12.3.135 Variable mon.stddev_messages</a>
<li><a href="#Variable-mon_002evalue_005ftemp0">12.3.136 Variable mon.value_temp0</a>
<li><a href="#Variable-mon_002eaverage_005ftemp0">12.3.137 Variable mon.average_temp0</a>
<li><a href="#Variable-mon_002estddev_005ftemp0">12.3.138 Variable mon.stddev_temp0</a>
<li><a href="#Variable-mon_002evalue_005ftemp1">12.3.139 Variable mon.value_temp1</a>
<li><a href="#Variable-mon_002eaverage_005ftemp1">12.3.140 Variable mon.average_temp1</a>
<li><a href="#Variable-mon_002estddev_005ftemp1">12.3.141 Variable mon.stddev_temp1</a>
<li><a href="#Variable-mon_002evalue_005ftemp2">12.3.142 Variable mon.value_temp2</a>
<li><a href="#Variable-mon_002eaverage_005ftemp2">12.3.143 Variable mon.average_temp2</a>
<li><a href="#Variable-mon_002estddev_005ftemp2">12.3.144 Variable mon.stddev_temp2</a>
<li><a href="#Variable-mon_002evalue_005ftemp3">12.3.145 Variable mon.value_temp3</a>
<li><a href="#Variable-mon_002eaverage_005ftemp3">12.3.146 Variable mon.average_temp3</a>
<li><a href="#Variable-mon_002estddev_005ftemp3">12.3.147 Variable mon.stddev_temp3</a>
<li><a href="#Variable-mon_002evalue_005fcpu">12.3.148 Variable mon.value_cpu</a>
<li><a href="#Variable-mon_002eaverage_005fcpu">12.3.149 Variable mon.average_cpu</a>
<li><a href="#Variable-mon_002estddev_005fcpu">12.3.150 Variable mon.stddev_cpu</a>
<li><a href="#Variable-mon_002evalue_005fcpu0">12.3.151 Variable mon.value_cpu0</a>
<li><a href="#Variable-mon_002eaverage_005fcpu0">12.3.152 Variable mon.average_cpu0</a>
<li><a href="#Variable-mon_002estddev_005fcpu0">12.3.153 Variable mon.stddev_cpu0</a>
<li><a href="#Variable-mon_002evalue_005fcpu1">12.3.154 Variable mon.value_cpu1</a>
<li><a href="#Variable-mon_002eaverage_005fcpu1">12.3.155 Variable mon.average_cpu1</a>
<li><a href="#Variable-mon_002estddev_005fcpu1">12.3.156 Variable mon.stddev_cpu1</a>
<li><a href="#Variable-mon_002evalue_005fcpu2">12.3.157 Variable mon.value_cpu2</a>
<li><a href="#Variable-mon_002eaverage_005fcpu2">12.3.158 Variable mon.average_cpu2</a>
<li><a href="#Variable-mon_002estddev_005fcpu2">12.3.159 Variable mon.stddev_cpu2</a>
<li><a href="#Variable-mon_002evalue_005fcpu3">12.3.160 Variable mon.value_cpu3</a>
<li><a href="#Variable-mon_002eaverage_005fcpu3">12.3.161 Variable mon.average_cpu3</a>
<li><a href="#Variable-mon_002estddev_005fcpu3">12.3.162 Variable mon.stddev_cpu3</a>
</li></ul>
</li></ul>
<li><a name="toc_Logs-and-records" href="#Logs-and-records">13 Logs and records</a>
<ul>
<li><a href="#Embedded-Databases">13.1 Embedded Databases</a>
<li><a href="#Text-logs">13.2 Text logs</a>
<li><a href="#Reports-in-outputs">13.3 Reports in outputs</a>
<li><a href="#Additional-reports-in-commcerical-cfengine-versions">13.4 Additional reports in commcerical cfengine versions</a>
<li><a href="#State-information">13.5 State information</a>
</li></ul>
</li></ul>
</div>



<!-- The file is structured like a programming language. Each chapter -->
<!-- starts with a chapter comment. -->
<!-- Menus list the subsections so that an online info-reader can parse -->
<!-- the file hierarchically. -->
   <p><script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">
var pageTracker = _gat._getTracker("UA-2576171-2");
pageTracker._initData();
pageTracker._trackPageview();
</script>

   <div class="footnote">
<hr>
<a name="texinfo-footnotes-in-document"></a><h4>Footnotes</h4><p class="footnote"><small>[<a name="fn-1" href="#fnd-1">1</a>]</small> There are
no if-then-else statements in cfengine; all decisions are made with classes.</p>

   <p class="footnote"><small>[<a name="fn-2" href="#fnd-2">2</a>]</small> There is no Da Vinci code in cfengine</p>

   <hr></div>

</body></html>