[Open-scap] Getting actual violations from OVAL results && USING xslt IN OSCAP

[Martin Preisler]

----- Original Message -----
> From: "AVNISH CHANDRA SUMAN" <avnishchandrasuman at gmail.com>
> To: open-scap-list at redhat.com
> Sent: Wednesday, April 23, 2014 8:09:40 AM
> Subject: [Open-scap] Getting actual violations from OVAL results && USING	xslt IN OSCAP
> 
> Q1.)I was working on a module that reads a oval result xml and prints the
> actual violations(tested_items that caused rule failure)
> I was told that this can be done directly by open-scap tool, but i couldn't
> find a way to get actual "failed tested_items" in results rather that just
> "true/false"
> Please let me know if there is a direct way of printing  violated items
> using open-scap tool.

AFAIK there is no inbuilt way to do this but it is easy to using basic pipe redirection.

You redirect to grep and use a simple regex to achieve this. Just grep for lines ending with ":false".

-- 
Martin Preisler