<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">On 12/13/13, 1:58 PM, Matthew Mariani wrote: </div> <blockquote cite="mid:1746095363.51857232.1386961118669.JavaMail.root@redhat.com" type="cite"> <pre wrap="">Hi Simon, Thanks. First, on this page <a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://www.open-scap.org/page/Debug">http://www.open-scap.org/page/Debug</a>, where are commands like 'configure' and 'run' found, as in lines like "./configure --enable-debug && make". My build process was to git the oscap repo, then run a Make in the scap-security-guide directory below. I'm seeing how to run 'configure' in this build model. [root@rhel6client scap-security-guide]# ls docs Fedora JBossEAP5 JBossFuse6 LICENSE Makefile OpenStack README RHEL6 RHEVM3 scap-security-guide.spec Attached are 1.) my XCCDF (package_checks.xml) in ..../RHEL6/input/system/software that calls 2.) my OVAL in .../RHEL6/input/checks (check_for_nonRH_packages.xml). I then built a simple profile to call just the ccp_check_for_nonRH_packages OVAL rule, along with a couple others. Results in the following error: [root@rhel6client ~]# ./run_rht_scap_new Title Check for Non-RH Signed Pacakages Rule ccp_check_for_nonRH_packages Ident (null) Result unknown OpenSCAP Error: No definition with ID: oval:ssg:def:3121 in result model. [oval_agent.c:180] [root@rhel6client ~]# [root@rhel6client ~]# grep "oval:ssg:def:3121" projects/scap-security-guide/RHEL6/output/ssg-rhel6-oval.xml <definition class="compliance" id="oval:ssg:def:3121" version="1"> [root@rhel6client ~]# Hope this helps. Again, it's great to debug this, but really I'm hoping to learn >how< to debug. Thanks in advance for taking a look. </pre> </blockquote> Debugging is no fun. Especially when you're debugging a single OVAL check in midst of a larger profile. Since you're using SSG, checkout the RHEL6/input/checks/testcheck.py script. It will take your OVAL, convert into proper schemas, and execute a single check (versus having to scan an entire profile). There's no magic sauce within the testcheck.py script; it only exposes the OVAL to OpenSCAP, utilizes the --oval-results flag that Simon mentioned, and will ensure OpenSCAP errors are send to stoud. I ran it against your OVAL (saved your OVAL locally as help.xml): $ ./testcheck.py help.xml Evaluating with OVAL tempfile : /tmp/check_for_nonRH_packagesfqU1jg.xml Writing results to : /tmp/check_for_nonRH_packagesfqU1jg.xml-results OpenSCAP Error: Probe at sd=1 (rpminfo) reported an error: Invalid type, value or format [oval_probe_ext.c:520] Based off that error, something within your rpminfo tags is invalid. The OVAL specs can be found here: <a class="moz-txt-link-freetext" href="http://oval.mitre.org/language/version5.6/ovaldefinition/documentation/linux-definitions-schema.html#rpminfo_test">http://oval.mitre.org/language/version5.6/ovaldefinition/documentation/linux-definitions-schema.html#rpminfo_test</a> So then, since you're asking how to debug, the next step would be to run through the spec and compare the OVAL code. </body> </html>