inventory/any.cf

bundle common inventory_any
{

  vars:
      "release_data" string => "$(this.promise_dirname)/../cf_promises_release_id";

      "data"
        data => readjson( $(release_data), inf ),
        if => fileexists( $(release_data) );

      "id"
        string => "$(data[releaseId])",
        meta => { "inventory", "attribute_name=Policy Release Id" };

  reports:
      "DEBUG|DEBUG_$(this.bundle)"::
        "DEBUG $(this.bundle): Inventory Policy Release Id=$(id)";
}

bundle agent inventory_autorun
{
  methods:
    !disable_inventory_cmdb::
      "cmdb" usebundle => cfe_autorun_inventory_cmdb(),
      handle => "cfe_internal_autorun_inventory_cmdb";

    !disable_inventory_LLDP::
      "LLDP" usebundle => cfe_autorun_inventory_LLDP(),
      handle => "cfe_internal_autorun_inventory_LLDP";

    !disable_inventory_package_refresh::
      "packages_refresh" usebundle => cfe_autorun_inventory_packages(),
      handle => "cfe_internal_autorun_inventory_packages";

    !disable_inventory_proc::
      "proc" usebundle => cfe_autorun_inventory_proc(),
      handle => "cfe_internal_autorun_inventory_proc";

      "proc_cpuinfo" usebundle => cfe_autorun_inventory_proc_cpuinfo(),
      handle => "cfe_internal_autorun_inventory_proc_cpuinfo";

    !disable_inventory_cpuinfo::
      "cpuinfo" usebundle => cfe_autorun_inventory_cpuinfo(),
      handle => "cfe_internal_autorun_inventory_cpuinfo";

    !disable_inventory_fstab::
      "fstab" usebundle => cfe_autorun_inventory_fstab(),
      handle => "cfe_internal_autorun_inventory_fstab";

    !disable_inventory_mtab::
      "mtab" usebundle => cfe_autorun_inventory_mtab(),
      handle => "cfe_internal_autorun_inventory_mtab";

    !disable_inventory_dmidecode::
      "dmidecode" usebundle => cfe_autorun_inventory_dmidecode(),
      handle => "cfe_internal_autorun_inventory_dmidecode";

    !disable_inventory_aws::
      "aws" usebundle => cfe_autorun_inventory_aws(),
        handle => "cfe_internal_autorun_inventory_aws";

    !disable_inventory_aws|disable_inventory_aws_ec2_metadata::
      "aws" usebundle => cfe_autorun_inventory_aws_ec2_metadata(),
        handle => "cfe_internal_autorun_inventory_ec2_metadata";

    !disable_inventory_setuid::
      "Inventory SetUID Files" -> { "ENT-4158" }
        usebundle => cfe_autorun_inventory_setuid(),
        handle => "cfe_internal_autorun_inventory_setuid";

    any::
      "listening ports" usebundle => cfe_autorun_inventory_listening_ports(),
      handle => "cfe_internal_autorun_listening_ports";

      "disk" usebundle => cfe_autorun_inventory_disk(),
      handle => "cfe_internal_autorun_disk";

      "memory" usebundle => cfe_autorun_inventory_memory(),
      handle => "cfe_internal_autorun_memory";

      "loadaverage" usebundle => cfe_autorun_inventory_loadaverage(),
      handle => "cfe_internal_autorun_loadaverage";

      "IP addresses" -> { "ENT-2552", "ENT-4987" }
        usebundle => cfe_autorun_inventory_ip_addresses,
        handle => "cfe_internal_autorun_ip_addresses";
}

bundle agent cfe_autorun_inventory_listening_ports
{
  vars:
      "ports" -> { "ENT-150" }
        slist => sort( "mon.listening_ports", "int"),
        meta => { "inventory", "attribute_name=Ports listening" },
        ifvarclass => some("[0-9]+", "mon.listening_ports"),
        comment => "We only want to inventory the listening ports if we have
                    values that make sense.";
}

bundle agent cfe_autorun_inventory_ip_addresses
{
  vars:
      "ipv4_regex" -> { "ENT-4987" }
        string => "\b(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\b";

      "ipv4_loopback_regex" -> { "ENT-2552" }
        string => "127\.0\.0\.1",
        comment => "Addresses that match this regular expression will be filtered
                    from the inventory for ipv4 addresses";

      "ipv6_loopback_regex" -> { "ENT-4987" }
        string => "::1",
        comment => "Addresses that match this regular expression will be filtered
                    from the inventory for ipv4 addresses";

    # Strings are displayed more beautifully in Mission Portal than lists, so
    # we first generate the list of addresses to be inventoried and then do
    # inventory using an array.
      "ipv4_addresses"
        slist => sort( filter( $(ipv4_regex), "sys.ip_addresses", "true", "false", inf), lex ),
        if => not( isvariable( $(this.promiser) ));

      "ipv4_addresses_non_loopback" -> { "ENT-2552" }
        slist => sort( filter( $(ipv4_loopback_regex), "$(this.bundle).ipv4_addresses", "true", "true", inf)),
        if => not( isvariable( $(this.promiser) ));

      "ipv4[$(ipv4_addresses_non_loopback)]" -> { "ENT-2552" }
        string => "$(ipv4_addresses_non_loopback)",
        meta => { "inventory", "attribute_name=IPv4 addresses" };

      # sys.ip_addresses contains ipv4 and (as of 3.15.0) ipv6 addresses. We get
      # the ipv6 addresses indirectly, based on excluding the ipv4 addresses
      # (which we identify using a regular expression)

      "ipv6_addresses" -> { "ENT-4987" }
        slist => sort( difference( "sys.ip_addresses", "$(this.bundle).ipv4_addresses" ), lex),
        if => not( isvariable( $(this.promiser) ));

      "ipv4_addresses_non_loopback" -> { "ENT-4987" }
        slist => sort( filter( $(ipv6_loopback_regex), "$(this.bundle).ipv4_addresses", "true", "true", inf)),
        if => not( isvariable( $(this.promiser) ));

      "ipv6[$(ipv6_addresses_non_loopback)]" -> { "ENT-4987" }
        string => "$(ipv6_addresses_non_loopback)",
        meta => { "inventory", "attribute_name=IPv6 addresses" };

  reports:
    DEBUG|DEBUG_cfe_autorun_inventory_ipv4_addresses::
      "DEBUG $(this.bundle)";
      "$(const.t)Inventorying: '$(ipv4_addresses)'";
      "$(const.t)Inventorying: '$(ipv6_addresses)'";
}

bundle agent cfe_autorun_inventory_disk
{
  vars:
    enterprise::
      "free" -> { "ENT-5190" }
        string => "$(mon.value_diskfree)",
        meta => { "inventory", "attribute_name=Disk free (%)" },
        if => isvariable( "mon.value_diskfree" );
}

bundle agent cfe_autorun_inventory_memory
{
  vars:
@if minimum_version(3.11)
      # The `with` attribute is necessary for this to work in a single promise.

    enterprise_edition.windows::

      # wmic returns "TotalVisibleMemorySize=10760224" so split on = and take
      # the second item (0-based with nth())

      "total" -> { "ENT-4188" }
        meta => { "inventory", "attribute_name=Memory size (MB)" },
        string => format( "%d", eval("$(with)/1024", "math", "infix" )),
        if => not( isvariable( "total" ) ),
        with => nth( string_split( execresult("wmic OS get TotalVisibleMemorySize /format:list", useshell ),
                                   "=", 2), 1);

      "totalPhysical" -> { "CFE-2896" }
        meta => { "inventory", "attribute_name=Physical memory (MB)" },
        string => format( "%d", eval("$(with)/1024", "math", "infix" )),
        if => not( isvariable( "total" ) ),
        with => nth( string_split( execresult("wmic ComputerSystem get TotalPhysicalMemory /format:list", useshell ),
                                   "=", 2), 1);

      # This is a volatile metric, perhaps  not well suited for inventory
      "free"
        meta => { "report" },
        string => format( "%d", eval("$(with)/1024", "math", "infix" )),
        if => not( isvariable( "free" ) ),
        with => nth( string_split( execresult("wmic OS get FreePhysicalMemory /format:list", useshell ),
                                   "=", 2), 1);
@endif
    enterprise_edition.aix::
      "total" -> { "CFE-2797", "CFE-2803" }
        string => execresult("/usr/bin/lparstat -i | awk '/Online Memory/ { print $4 }'", "useshell"),
        meta => { "inventory", "attribute_name=Memory size (MB)" };

    enterprise_edition.hpux::
       "total" -> { "ENT-4188" }
         string => execresult( "machinfo | awk '/^Memory =/ {print $3}'", useshell ),
         meta => { "inventory", "attribute_name=Memory size (MB)" };

    enterprise_edition.!(aix|windows|hpux)::
      "total" string => "$(mon.value_mem_total)",
        meta => { "inventory", "attribute_name=Memory size (MB)" },
        if => isvariable( "mon.value_mem_total" );

      "free" string => "$(mon.value_mem_free)",
        if => and( not( isvariable( "free" ) ),
                   isvariable( "mon.value_mem_free" )),
        meta => { "report" };

}

bundle agent cfe_autorun_inventory_setuid
{
  vars:
    !disable_inventory_setuid::
      "candidates" slist => lsdir( "$(sys.workdir)", "cfagent\..*\.log", true );

      "setuid_log_path"
        comment => "We select the file that matches the downcased version of the
                    hostname since sys.fqhost always returns lower case",
        string => "$(candidates)",
        if => strcmp( "$(sys.workdir)/cfagent.$(sys.fqhost).log",
                      string_downcase($(candidates)));

      "files" slist => readstringlist( $(setuid_log_path), "", "$(const.n)", inf, inf);

      "setuid[$(files)]"
        string => "$(files)",
        meta => { "inventory", "attribute_name=Setuid files" },
        if => regcmp( "104\d+", filestat( $(files), modeoct ) );

      "rootsetuid[$(files)]"
        string => "$(files)",
        meta => { "inventory", "attribute_name=Root owned setuid files" },
        if => and( regcmp( "104\d+", filestat( $(files), modeoct ) ),
                   regcmp( "0", filestat( $(files), uid ) ));

    files:
    !disable_inventory_setuid::
      "$(setuid_log_path)"
        comment => "If the logged file is not currently setuid then we can
                    safely purge it from the list to avoid unnecessary work.",
        edit_line => delete_lines_matching( escape( $(files) ) ),
        if => not( regcmp( "104\d+", filestat( $(files), modeoct ) ) );

  reports:
    !disable_inventory_setuid.(DEBUG|DEBUG_cfe_autorun_inventory_setuid)::
      "$(setuid_log_path) present"
        if =>  fileexists( $(setuid_log_path) );

@if minimum_version(3.11)

      "Candidate: setuid Files: $(files) modeoct=$(with)"
        with => filestat( $(files), modeoct );

      "Remove $(files) from log by matching $(with)"
        comment => "If the logged file is not currently setuid then we can
                    safely purge it from the list to avoid unnecessary work.",
        with =>  escape( $(files) ),
        if => not( regcmp( "104\d+", filestat( $(files), modeoct ) ) );

      # The `with` attribute was introduced in 3.11
      "Inventory: setuid Files: $(files) modeoct=$(with)"
        with => filestat( $(files), modeoct ),
        if => regcmp( "104\d+", filestat( $(files), modeoct ) );

      "Inventory: root owned setuid Files: $(files) modeoct=$(with)"
        with => filestat( $(files), modeoct ),
        if => and( regcmp( "104\d+", filestat( $(files), modeoct ) ),
                   regcmp( "0", filestat( $(files), uid ) ));
@endif

}

bundle agent cfe_autorun_inventory_loadaverage
{
  vars:
    enterprise::
      "value" -> { "ENT-5190" }
        string => "$(mon.value_loadavg)",
        meta => { "report" },
        if => isvariable( "mon.value_loadavg" );
}

bundle agent cfe_autorun_inventory_proc
{
  vars:
      "basefiles" slist => { "consoles", "cpuinfo", "modules", "partitions", "version" };
      "files[$(basefiles)]" string => "$(inventory_control.proc)/$(basefiles)";

    _have_proc_consoles::
      "console_count" int =>  readstringarrayidx("consoles",
                                                 "$(files[consoles])",
                                                 "\s*#[^\n]*",
                                                 "\s+",
                                                 500,
                                                 50000);

      "console_idx" slist => getindices("consoles");

    _have_proc_modules::
      "module_count" int =>  readstringarrayidx("modules",
                                                "$(files[modules])",
                                                "\s*#[^\n]*",
                                                "\s+",
                                                2500,
                                                250000);

      "module_idx" slist => getindices("modules");

    _have_proc_cpuinfo::
      # this will extract all the keys in one bunch, so you won't get
      # detailed info for processor 0 for example
      "cpuinfo_count" int =>  readstringarrayidx("cpuinfo_array",
                                                 "$(files[cpuinfo])",
                                                 "\s*#[^\n]*",
                                                 "\s*:\s*",
                                                 500,
                                                 50000);

      "cpuinfo_idx" slist => getindices("cpuinfo_array");
      "cpuinfo[$(cpuinfo_array[$(cpuinfo_idx)][0])]" string => "$(cpuinfo_array[$(cpuinfo_idx)][1])";
      "cpuinfo_keys" slist => getindices("cpuinfo");

    _have_proc_partitions::
      "partitions_count" int =>  readstringarrayidx("partitions_array",
                                                    "$(files[partitions])",
                                                    "major[^\n]*",
                                                    "\s+",
                                                    500,
                                                    50000);

      "partitions_idx" slist => getindices("partitions_array");
      "partitions[$(partitions_array[$(partitions_idx)][4])]" string => "$(partitions_array[$(partitions_idx)][3])";
      "partitions_keys" slist => getindices("partitions");

    _have_proc_version::
      "version" string => readfile("$(files[version])", 2048);

  classes:
      "have_proc" expression => isdir($(inventory_control.proc));

    have_proc::
      "_have_proc_$(basefiles)"
      expression => fileexists("$(files[$(basefiles)])");

    _have_proc_consoles::
      "have_console_$(consoles[$(console_idx)][0])"
      expression => "any",
      scope => "namespace";

    _have_proc_modules::
      "have_module_$(modules[$(module_idx)][0])"
      expression => "any",
      scope => "namespace";

  reports:
    _have_proc_consoles.verbose_mode::
      "$(this.bundle): we have console $(consoles[$(console_idx)][0])";
    _have_proc_modules.verbose_mode::
      "$(this.bundle): we have module $(modules[$(module_idx)][0])";
    _have_proc_cpuinfo.verbose_mode::
      "$(this.bundle): we have cpuinfo $(cpuinfo_keys) = $(cpuinfo[$(cpuinfo_keys)])";
    _have_proc_partitions.verbose_mode::
      "$(this.bundle): we have partitions $(partitions_keys) with $(partitions[$(partitions_keys)]) blocks";
    _have_proc_version.verbose_mode::
      "$(this.bundle): we have kernel version '$(version)'";
}

bundle agent cfe_autorun_inventory_proc_cpuinfo
{
  classes:
    "_have_cpuinfo" expression => isvariable("default:cfe_autorun_inventory_proc.cpuinfo_idx");

      # So that we don't inventory non dereferenced variables we check to see
      # if we have the info first This is only necessary because its currently
      # invalid to do isvariable on an array key that contains a space
      # Ref: redmine#7088 https://dev.cfengine.com/issues/7088
      "have_cpuinfo_cpu_cores" expression => strcmp("cpu cores", "$(default:cfe_autorun_inventory_proc.cpuinfo_array[$(default:cfe_autorun_inventory_proc.cpuinfo_idx)][0])");
      "have_cpuinfo_model_name" expression => strcmp("model name", "$(default:cfe_autorun_inventory_proc.cpuinfo_array[$(default:cfe_autorun_inventory_proc.cpuinfo_idx)][0])");

  vars:
    _have_cpuinfo::
      "cpuinfo_physical_cores"
        string => "$(default:cfe_autorun_inventory_proc.cpuinfo[cpu cores])",
        ifvarclass => "have_cpuinfo_cpu_cores";

      "cpuinfo_cpu_model_name"
        string => "$(default:cfe_autorun_inventory_proc.cpuinfo[model name])",
        ifvarclass => "have_cpuinfo_model_name";

    # We need to be able to count the number of unique physical id lines in
    # /proc/cpu in order to get a physical processor count.
      "cpuinfo_lines" slist => readstringlist(
                                                 "$(default:cfe_autorun_inventory_proc.files[cpuinfo])",
                                                 "\s*#[^\n]*",
                                                 "\n",
                                                 500,
                                                 50000);

      "cpuinfo_processor_lines"
        slist => grep("processor\s+:\s\d+", "cpuinfo_lines"),
        comment => "The number of processor entries in $(default:cfe_autorun_inventory_proc.files[cpuinfo]). If no
                    'physical id' entries are found this is the processor count";

      "cpuinfo_processor_lines_count"
        int => length("cpuinfo_processor_lines");

      "cpuinfo_physical_id_lines"
        slist => grep("physical id.*", "cpuinfo_lines"),
        comment => "This identifies which physical socket a logical core is on,
                    the count of the unique physical id lines tells you how
                    many physical sockets you have. THis would not be present
                    on systems that are not multicore.";

      "cpuinfo_physical_id_lines_unique"
        slist => unique("cpuinfo_physical_id_lines");

      "cpuinfo_physical_id_lines_unique_count"
        int => length("cpuinfo_physical_id_lines_unique");


      # If we have physical id lines in cpu info use that for socket inventory,
      # else we should use the number of processor lines. physical id lines
      # seem to only be present when multiple cores are active.
      "cpuinfo_physical_socket_inventory"
        string => ifelse(isgreaterthan( length("cpuinfo_physical_id_lines"), 0 ), "$(cpuinfo_physical_id_lines_unique_count)",
                      "$(cpuinfo_processor_lines_count)"),
        meta => { "inventory", "attribute_name=CPU sockets" };

  reports:
    DEBUG|DEBUG_cfe_autorun_inventory_proc::
     "DEBUG $(this.bundle)";
     "$(const.t)cpuinfo[$(default:cfe_autorun_inventory_proc.cpuinfo_array[$(default:cfe_autorun_inventory_proc.cpuinfo_idx)][0])] = $(default:cfe_autorun_inventory_proc.cpuinfo[$(default:cfe_autorun_inventory_proc.cpuinfo_array[$(default:cfe_autorun_inventory_proc.cpuinfo_idx)][0])])";
     "$(const.t)CPU physical cores: '$(cpuinfo_physical_cores)'"
        ifvarclass => "have_cpuinfo_cpu_cores";
     "$(const.t)CPU model name: '$(cpuinfo_cpu_model_name)'"
        ifvarclass => "have_cpuinfo_model_name";
     "$(const.t)CPU Physical Sockets: '$(cpuinfo_physical_socket_inventory)'";
}

bundle agent cfe_autorun_inventory_cpuinfo
{
  classes:
    "_have_proc_cpu_model_name" expression => isvariable("default:cfe_autorun_inventory_proc_cpuinfo.cpuinfo_cpu_model_name");
    "_have_proc_cpu_physical_cores" expression => isvariable("default:cfe_autorun_inventory_proc_cpuinfo.cpuinfo_physical_cores");

    # We only accept dmidecode values that don't look like cfengine variables,
    # (starting with dollar), or that have an apparent empty value.
    "_have_dmidecode_cpu_model_name"
      not => regcmp("($(const.dollar)\(.*\)|^$)", "$(default:cfe_autorun_inventory_dmidecode.dmi[processor-version])");

  vars:
    _have_proc_cpu_physical_cores::
      "cpuinfo_physical_cores"
        string => "$(default:cfe_autorun_inventory_proc.cpuinfo[cpu cores])",
        #ifvarclass => "have_cpuinfo_cpu_cores",
        meta => { "inventory", "attribute_name=CPU physical cores", "derived-from=$(default:cfe_autorun_inventory_proc.files[cpuinfo])" };

    _have_proc_cpu_model_name::
      "cpu_model"
        string => "$(default:cfe_autorun_inventory_proc_cpuinfo.cpuinfo_cpu_model_name)",
        meta => { "inventory", "attribute_name=CPU model", "derived-from=$(default:cfe_autorun_inventory_proc.files[cpuinfo])" };

    _have_dmidecode_cpu_model_name.!_have_proc_cpu_model_name::
      "cpu_model"
        string => "$(default:cfe_autorun_inventory_dmidecode.dmi[processor-version])",
        meta => { "inventory", "attribute_name=CPU model", "derived-from=$(inventory_control.dmidecoder) -s processor-version" };

  reports:
    DEBUG|DEBUG_cfe_autorun_inventory_cpuinfo::
      "DEBUG $(this.bundle)";
      "$(const.t) CPU model: $(cpu_model)";
      "$(const.t) CPU physical cores: $(cpuinfo_physical_cores)";
}

bundle common cfe_autorun_inventory_aws
{
  classes:
    !disable_inventory_aws::
      "ec2_instance" -> { "CFE-2924" }
        comment => "See http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/identify_ec2_instances.html",
        scope => "namespace",
        expression => regcmp("^[eE][cC]2.*", "$(cfe_autorun_inventory_dmidecode.dmi[system-uuid])"),
        if => isvariable("cfe_autorun_inventory_dmidecode.dmi[system-uuid]");

      "ec2_instance" -> { "CFE-2924" }
        expression => regcmp(".*[aA]mazon.*", "$(cfe_autorun_inventory_dmidecode.dmi[bios-version])"),
        scope => "namespace",
        if => isvariable("cfe_autorun_inventory_dmidecode.dmi[bios-version]");

      "ec2_instance" -> { "CFE-2924" }
        expression => regcmp(".*[aA]mazon.*", "$(cfe_autorun_inventory_dmidecode.dmi[bios-vendor])"),
        scope => "namespace",
        if => isvariable("cfe_autorun_inventory_dmidecode.dmi[bios-vendor]");

      "ec2_instance" -> { "CFE-2924" }
        expression => regline( "^ec2.*", "/sys/hypervisor/uuid" ),
        scope => "namespace",
        if => fileexists("/sys/hypervisor/uuid");

  reports:
    (DEBUG|DEBUG_inventory_aws)::
      "DEBUG $(this.bundle)";

      "$(const.t)+ec2_instance"
        if => "ec2_instance";
}

bundle agent cfe_autorun_inventory_aws_ec2_metadata
{
  methods:
    !(disable_inventory_aws|disable_inventory_aws_ec2_metadata)::
      "cfe_autorun_inventory_aws_ec2_metadata_cache";
      "cfe_aws_ec2_metadata_from_cache";
}

bundle agent cfe_autorun_inventory_aws_ec2_metadata_cache
{

  vars:
    ec2_instance.!(disable_inventory_aws|disable_inventory_aws_ec2_metadata)::
      "URL"       string => "http://169.254.169.254/latest/dynamic/instance-identity/document";
      "cache"     string => "$(sys.statedir)/aws_ec2_metadata";

      "v" -> { "ENT-5233" }
        string => ifelse( isgreaterthan( $(sys.cf_version_minor), 14), "suppress_inform_capable",
                          "suppress_inform_incapable");

      "response" -> { "ENT-4900" }
        data => url_get($(URL), '{"url.max_content": 512000, "url.timeout": 1}'),
        # To prevent `url_get` from firing on every agent run, this variable
        # depends on a dummy command which does nothing but fires only once a day
        depends_on => { "daily_dummy_job_$(v)" };

  commands:
    _stdlib_path_exists_true::

      "$(paths.true)"
        comment => "This promise is used for delaying execution of url_get, since locking does not work directly on vars type promises",
        classes => kept_successful_command,
        handle => "daily_dummy_job_suppress_inform_incapable",
        action => if_elapsed_day,
        if => strcmp( "daily_dummy_job_$(v)", "daily_dummy_job_suppress_inform_incapable" );

@if minimum_version(3.15.0)
      "$(paths.true)"
        comment => "This promise is used for delaying execution of url_get, since locking does not work directly on vars type promises",
        classes => kept_successful_command,
        handle => "daily_dummy_job_suppress_inform_capable",
        inform => "false",
        action => if_elapsed_day;
@endif

  files:
    ec2_instance.!(disable_inventory_aws|disable_inventory_aws_ec2_metadata)::

    cfengine_3_10::
      "$(cache)"
        create => "true",
        edit_line => lines_present( "$(response[content])" ),
        edit_defaults => empty,
        if => isvariable( response );

@if minimum_version(3.11)
      # template_method inline_mustache introduced in 3.11
    !cfengine_3_10::
      "$(cache)"
        template_method => "inline_mustache",
        edit_template_string => "}",
        template_data => @(response),
        create =>   "true",
        if => isvariable( response );
@endif
}

bundle agent cfe_aws_ec2_metadata_from_cache
{
  classes:

    ec2_instance.!(disable_inventory_aws|disable_inventory_aws_ec2_metadata)::

      "have_cached_instance_identity"
        expression => fileexists( $(cfe_autorun_inventory_aws_ec2_metadata_cache.cache) );

  vars:

    have_cached_instance_identity.ec2_instance.!(disable_inventory_aws|disable_inventory_aws_ec2_metadata)::

      "data" data => readjson( $(cfe_autorun_inventory_aws_ec2_metadata_cache.cache), 100K);

      "region" string => "$(data[region])", meta => { "inventory", "attribute_name=EC2 Region" };
      "instanceId" string => "$(data[instanceId])", meta => { "inventory", "attribute_name=EC2 Instance ID" };
      "instanceType" string => "$(data[instanceType])", meta => { "inventory", "attribute_name=EC2 Instance Type" };
      "imageId" string => "$(data[imageId])", meta => { "inventory", "attribute_name=EC2 Image ID" };
      "availabilityZone" string => "$(data[availabilityZone])", meta => { "inventory", "attribute_name=EC2 Availability Zone" };

  reports:

    DEBUG|DEBUG_inventory_ec2_metadata|DEBUG_inventory_ec2_metadata_from_cache::
      "DEBUG $(this.bundle):";
      "$(const.t)Inventory 'EC2 Region' = '$(region)'";
      "$(const.t)Inventory 'EC2 Instance ID' = '$(instanceId)'";
      "$(const.t)Inventory 'EC2 Instance Type' = '$(instanceType)'";
      "$(const.t)Inventory 'EC2 Image ID' = '$(imageId)'";
      "$(const.t)Inventory 'EC2 Availability Zone' = '$(availabilityZone)'";
}

bundle agent cfe_autorun_inventory_mtab
{
  vars:
    have_mtab::
      "mount_count" int =>  readstringarrayidx("mounts",
                                               $(inventory_control.mtab),
                                               "\s*#[^\n]*",
                                               "\s+",
                                               500,
                                               50000);

      "idx" slist => getindices("mounts");

  classes:
      "have_mtab" expression => fileexists($(inventory_control.mtab));

      # define classes like have_mount_ext4__var for a ext4 /var mount
      "have_mount_$(mounts[$(idx)][2])_$(mounts[$(idx)][1])"
      expression => "any",
      scope => "namespace";

      # define classes like have_mount_ext4 if there is a ext4 mount
      "have_mount_$(mounts[$(idx)][2])"
      expression => "any",
      scope => "namespace";

  reports:
    verbose_mode::
      "$(this.bundle): we have a $(mounts[$(idx)][2]) mount under $(mounts[$(idx)][1])";
}

bundle agent cfe_autorun_inventory_fstab
{
  vars:
    have_fstab::
      "mount_count" int =>  readstringarrayidx("mounts",
                                               $(sys.fstab),
                                               "\s*#[^\n]*",
                                               "\s+",
                                               500,
                                               50000);

      "idx" slist => getindices("mounts");

  classes:
      "have_fstab" expression => fileexists($(sys.fstab));

      # define classes like have_fs_ext4__var for a ext4 /var entry
      "have_fs_$(mounts[$(idx)][2])_$(mounts[$(idx)][1])"
      expression => "any",
      scope => "namespace";

      # define classes like have__var for a /var entry
      "have_fs_$(mounts[$(idx)][1])"
      expression => "any",
      scope => "namespace";

      # define classes like have_fs_ext4 if there is a ext4 entry
      "have_fs_$(mounts[$(idx)][2])"
      expression => "any",
      scope => "namespace";

  reports:
    verbose_mode::
      "$(this.bundle): we have a $(mounts[$(idx)][2]) fstab entry under $(mounts[$(idx)][1])";
}

bundle agent cfe_autorun_inventory_dmidecode
{

  vars:
    any::
      "sysfs_name_for"
        comment => "The names in /sys/devices/virtual/dmi/id/ don't match
                    the strings to be passed to dmidecode, even though the
                    values do.  We use the dmidecode string names for our
                    variables since that was the original source (i.e. for
                    backward compatibility with policies based on prior
                    versions of this code).",
        # system-version has no equivalent in sysfs that I can find.
        # Items after the line break aren't currently collected, but mapping is provided
        # in case someone adds them to a custom dmidefs (so that they could be gotten
        # from sysfs in that case).
        data => parsejson('
          {
            "bios-vendor": "bios_vendor",
            "bios-version": "bios_version",
            "system-serial-number": "product_serial",
            "system-manufacturer": "sys_vendor",
            "system-product-name": "product_name",
            "system-uuid": "product_uuid",

            "baseboard-manufacturer": "board_vendor",
            "baseboard-product-name": "board_name",
            "baseboard-serial-number": "board_serial",
            "baseboard-version": "board_version",
            "bios-release-date": "bios_date",
            "chassis-manufacturer": "chassis_vendor",
          }');

  vars:
    any::
      # The dmidefs variable controls which values are collected
      # (and what are their inventory tags)
      "dmidefs" data => parsejson('
{
  "bios-vendor": "BIOS vendor",
  "bios-version": "BIOS version",
  "system-serial-number": "System serial number",
  "system-manufacturer": "System manufacturer",
  "system-version": "System version",
  "system-product-name": "System product name",
  "system-uuid": "System UUID",
}');

      # We override dmidefs from augments when we can.

      "dmidefs" -> { "CFE-2927" }
        data => mergedata( "def.cfe_autorun_inventory_dmidecode[dmidefs]" ),
        if => isvariable( "def.cfe_autorun_inventory_dmidecode[dmidefs]");

      # other dmidecode variables you may want:
      # baseboard-asset-tag
      # baseboard-manufacturer
      # baseboard-product-name
      # baseboard-serial-number
      # baseboard-version
      # bios-release-date
      # chassis-asset-tag
      # chassis-manufacturer
      # chassis-serial-number
      # chassis-type
      # chassis-version
      # processor-family
      # processor-frequency
      # processor-manufacturer
      #"processor-version": "CPU model" <- Collected by default, but not by iterating over the list

      "dmivars" slist => getindices(dmidefs);

    have_dmidecode::
      "decoder" string => "$(inventory_control.dmidecoder)";

    have_dmidecode._stdlib_path_exists_awk.!(redhat_4|redhat_3)::
      # Awk script from https://kb.vmware.com/s/article/53609
      # Edited only to add "-t1" (an improvement tested on RHEL 4/5/6/7 and FreeBSD)
      # and to take out the "UUID: " prefix in the output.
      # This works on a superset of systems where dmidecode -s system-uuid works,
      # e.g. RHEL 5 with dmidecode-2.7-1.28.2.el5 where system-uuid is not one of the valid keywords;
      # also, this returns the correct UUID on systems (such as VMWare VMs with hardware version 13)
      # where dmidecode -s system-uuid shows the wrong UUID.  Some such VMWare VMs also show the
      # wrong UUID in sysfs, which is why we prefer the "dmidecode | awk" version to sysfs for UUID.
      # (We still need to check sysfs for UUID to handle hosts without dmidecode such as CoreOS.)
      "dmi[system-uuid]"
        string => execresult(
          "$(decoder) -u -t1 |
            $(paths.awk) '
              BEGIN { in1 = 0; hd = 0}
              /, DMI type / { in1 = 0 }
              /Strings:/ { hd = 0 }
              { if (hd == 2) { printf \"%s-%s\n\", $1 $2, $3 $4 $5 $6 $7 $8; hd = 0 } }
              { if (hd == 1) { printf \"%s-%s-%s-\", $9 $10 $11 $12, $13 $14, $15 $16; hd = 2 } }
              /, DMI type 1,/ { in1 = 1 }
              /Header and Data:/ { if (in1 != 0) { hd = 1 } }
            '",
          "useshell" ),
        if => isvariable("dmidefs[system-uuid]"), # Only run this if system-uuid is marked for collection in dmidefs
        meta => { "inventory", "attribute_name=$(dmidefs[system-uuid])" };

    !disable_inventory_dmidecode.!windows::
    # The reason disable_inventory_dmidecode is referenced here but not in the other context lines
    # is because those vars depend on have_dmidecode which won't be set during pre-eval (and won't
    # be set at all if this bundle isn't called).  Without this guard here, we would attempt to
    # read sysfs even if dmi inventory were turned off on the host via disable_inventory_dmidecode,
    # which would be undesirable.
      "dmi[$(dmivars)]"
        unless => isvariable("dmi[$(dmivars)]"), # This is just for system-uuid really, which we get from the awk script above by preference.
        if =>   fileexists("/sys/devices/virtual/dmi/id/$(sysfs_name_for[$(dmivars)])"),
        string => readfile("/sys/devices/virtual/dmi/id/$(sysfs_name_for[$(dmivars)])", 0),
        meta => { "inventory", "attribute_name=$(dmidefs[$(dmivars)])" };

    # Redhat 4 can support the -s option to dmidecode if
    # kernel-utils-2.4-15.el4 or greater is installed.
    have_dmidecode.!(redhat_4|redhat_3)::
      "dmi[$(dmivars)]" string => execresult("$(decoder) -s $(dmivars)",
                                             "useshell"),
      unless => isvariable("dmi[$(dmivars)]"), # If already defined from sysfs, don't run dmidecode
      meta => { "inventory", "attribute_name=$(dmidefs[$(dmivars)])" };

      # We do not want to inventory the model name from here, as inventory for
      # CPU info has been abstracted away from DMI so we just collect it
      # manually.

      "dmi[processor-version]" string => execresult("$(decoder) -s processor-version",
                                             "useshell");

    windows.powershell::
      "dmi[bios-vendor]" string => $(bios_array[1]),
      meta => { "inventory", "attribute_name=BIOS vendor" };

      "dmi[system-serial-number]" string => $(bios_array[2]),
      meta => { "inventory", "attribute_name=System serial number" };

      "dmi[bios-version]" string => $(bios_array[3]),
      meta => { "inventory", "attribute_name=BIOS version" };

      "dmi[system-version]" string => $(bios_array[4]),
      meta => { "inventory", "attribute_name=System version" };

      "dmi[processor-version]" string => $(processor_array[1]);

      "split_pscomputername"
        slist => string_split($(system_array[1]), "PSComputerName\s.*", 2),
        comment => "Work around weird appearance of PSComputerName into System manufacturer";

      "dmi[system-manufacturer]" string => nth(split_pscomputername, 0),
      meta => { "inventory", "attribute_name=System manufacturer" };

  classes:
      "have_dmidecode" expression => fileexists($(inventory_control.dmidecoder));

    windows.powershell::
      "bios_match" expression => regextract(".*Manufacturer\s+:\s([a-zA-Z0-9 ]+)\n.*SerialNumber\W+([a-zA-Z0-9 ]+).*SMBIOSBIOSVersion\W+([a-zA-Z0-9 ]+).*Version\W+([a-zA-Z0-9 -]+)",
                                            execresult("gwmi -query 'SELECT SMBIOSBIOSVersion, Manufacturer, SerialNumber, Version FROM WIN32_BIOS'", "powershell"),
                                            "bios_array");

      "processor_match" expression => regextract(".*Name\W+(.*)",
                                                 execresult("gwmi -query 'SELECT Name FROM WIN32_PROCESSOR'", "powershell"),
                                                 "processor_array");

      "system_match" expression => regextract(".*Manufacturer\W+(.*)",
                                              execresult("gwmi -query 'SELECT Manufacturer FROM WIN32_COMPUTERSYSTEM'", "powershell"),
                                              "system_array");

  # BEGIN Inventory Total Physical Memory MB
  vars:

      "total_physical_memory_MB" -> { "CFE-2896" }
        string => readfile( "$(sys.statedir)/inventory-$(this.bundle)-total-physical-memory-MB.txt", 100),
        meta => { "inventory", "attribute_name=Physical memory (MB)" },
        if => fileexists( "$(sys.statedir)/inventory-$(this.bundle)-total-physical-memory-MB.txt" );

  commands:

    have_dmidecode::

      "$(decoder) -t 17 | $(paths.awk) '/Size.*MB/ {s+=$2} END {print s}' > '$(sys.statedir)/inventory-$(this.bundle)-total-physical-memory-MB.txt'" -> { "CFE-2896" }
        contain => in_shell,
        if => not( fileexists( "$(sys.statedir)/inventory-$(this.bundle)-total-physical-memory-MB.txt") );

  files:

      "$(sys.statedir)/inventory-$(this.bundle)-total-physical-memory-MB.txt" -> { "CFE-2896" }
        delete => tidy,
        file_select => older_than(0, 0, 1, 0, 0, 0),
        comment => "Clear the cached value for total physical memory MB once a day.";

  # END Inventory Total Physical Memory MB

  reports:
    DEBUG|DEBUG_cfe_autorun_inventory_dmidecode::
      "DEBUG $(this.bundle): Obtained $(dmidefs[$(dmivars)]) = '$(dmi[$(dmivars)])'";
      "DEBUG $(this.bundle): Obtained Physical memory (MB) = '$(total_physical_memory_MB)'";
}

bundle agent cfe_autorun_inventory_LLDP
{
  classes:
      "lldpctl_exec_exists" expression => fileexists($(inventory_control.lldpctl_exec));

  vars:
    !disable_inventory_LLDP.lldpctl_exec_exists::
      # TODO When CFE-3108 is DONE, migrate to capturing only stdout
      "info" -> { "CFE-3109", "CFE-3108" }
        data => parsejson(execresult("$(inventory_control.lldpctl_json) 2>/dev/null", "useshell")),
        if => not(isvariable("def.lldpctl_json")),
        comment => "Not all versions of lldpctl support json, and because an
        absent lldpd will result in an error on stderr resulting noisy logs and
        failure to parse the json we redirect to dev null";

      "info" -> { "CFE-3109" }
        data => parsejson(execresult($(inventory_control.lldpctl_json), "noshell")),
        if => isvariable("def.lldpctl_json"),
        comment => "For safety, we do not run lldpctl in a shell if the path to
        lldpctl is customized via augments";
}

bundle agent cfe_autorun_inventory_packages
{
  classes:
      "have_patches" or => { "community_edition", # not in Community
                             fileexists("$(sys.workdir)/state/software_patches_avail.csv") };

      "have_inventory" and => { "have_patches",
                                fileexists("$(sys.workdir)/state/software_packages.csv"),
      };

  vars:
      # if we have the patches, 7 days; otherwise keep trying
      "refresh" string => ifelse("have_inventory", "10080",
                                 "0");

  packages:

    # The legacy implementation (package_method) of the packages type promise
    # requires a packages promise to be triggered in order to generate package
    # inventory. The following promises ensure that package inventory data
    # exists. As package modules become available the package_methods should be
    # removed.

    suse|sles::
      "cfe_internal_non_existing_package"
      package_policy => "add",
      package_method => inventory_zypper($(refresh)),
      action => if_elapsed_day;

    aix::
      "cfe_internal_non_existing_package"
      package_policy => "add",
      package_method => inventory_lslpp($(refresh)),
      action => if_elapsed_day;

    gentoo::
      "cfe_internal_non_existing_package"
      package_policy => "add",
      package_method => emerge,
      action => if_elapsed_day;

    !redhat.!debian.!gentoo.!(suse|sles).!aix::
      "cfe_internal_non_existing_package"
      package_policy => "add",
      package_method => generic,
      action => if_elapsed_day;

  reports:
    DEBUG|DEBUG_cfe_autorun_inventory_packages::
      "DEBUG $(this.bundle): refresh interval is $(refresh)";
      "DEBUG $(this.bundle): we have the inventory files."
        ifvarclass => "have_inventory";
      "DEBUG $(this.bundle): we don't have the inventory files."
        ifvarclass => "!have_inventory";
}

bundle agent cfe_autorun_inventory_cmdb
{
  vars:
      "cmdb_dir" string => "$(sys.workdir)/cmdb",
      comment => "CMDB directory location",
      meta => { "cmdb" };

      "cmdb_file" string => "$(cmdb_dir)/me.json",
      comment => "CMDB file location",
      meta => { "cmdb" };

  files:
      "$(cmdb_file)"
      copy_from => inventory_cmdb_copy_from,
      classes => inventory_scoped_classes_generic("bundle", "cmdb_file");

  methods:
    cmdb_file_ok::
      "load CMDB file" usebundle => inventory_cmdb_load($(cmdb_file));
}

bundle agent inventory_cmdb_load(file)
{
  classes:
      "have_cmdb_data" expression => isvariable("cmdb");

      "$(ckeys)" expression => "any", scope => "namespace";

  vars:
      "cmdb"
        data => readjson($(file), "999999"),
        ifvarclass => fileexists( $(file) );

      "cmdb_string"
      string => format("%S", cmdb),
        ifvarclass => isvariable( cmdb );

      "bkeys" slist => getindices("cmdb[vars]");
      "vkeys_$(bkeys)" slist => getindices("cmdb[vars][$(bkeys)]");
      "$(vkeys_$(bkeys))" string => nth("cmdb[vars][$(bkeys)]", $(vkeys));

      "ckeys" slist => getindices("cmdb[classes]");

  reports:
    DEBUG|DEBUG_inventory_cmdb_load::
      "DEBUG $(this.bundle): Got CMDB data from $(file): $(cmdb_string)"
        ifvarclass => "have_cmdb_data";
      "DEBUG $(this.bundle): Got CMDB key = $(vkeys_$(bkeys)), CMDB value = $((vkeys_$(bkeys)))"
        ifvarclass => "have_cmdb_data";
      "DEBUG $(this.bundle): Got CMDB class = $(ckeys)"
        ifvarclass => "have_cmdb_data";
      "DEBUG $(this.bundle): Could not read the CMDB data from $(file)"
        ifvarclass => "!have_cmdb_data";
}

body package_method inventory_lslpp(update_interval)
{
      package_changes => "individual";

      package_list_update_command => "/usr/bin/true";
      package_list_update_ifelapsed => $(update_interval);

      package_list_command       => "/usr/bin/lslpp -Lqc"; # list RPMs too
      package_list_version_regex => "[^:]+:[^:]+:([^:]+):.*";
      # Make sure version is not included in the name, that indicates RPM
      # packages, which we should ignore.
      package_list_name_regex    => "[^:]+:(([^-:]|-[^0-9])+):.*";
      package_installed_regex    => "[^:]+:(([^-:]|-[^0-9])+):[^:]+:[^:]+:.*";

      package_name_convention    => "$(name)-$(version).+";

      package_add_command    => "/usr/bin/true";
      package_update_command => "/usr/bin/true";
      package_patch_command  => "/usr/bin/true";
      package_delete_command => "/usr/bin/true";
      package_verify_command => "/usr/bin/true";
}

body package_method inventory_zypper(update_interval)
{
      package_changes => "bulk";

      package_list_command => "$(paths.path[rpm]) -qa --queryformat \"i | repos | %{name} | %{version}-%{release} | %{arch}\n\"";

      # set it to "0" to avoid caching of list during upgrade
      package_list_update_command => "$(suse_knowledge.call_zypper) list-updates";
      package_list_update_ifelapsed => $(update_interval);

      package_patch_list_command => "$(suse_knowledge.call_zypper) patches";
      package_installed_regex => "i.*";
      package_list_name_regex    => "$(rpm_knowledge.rpm_name_regex)";
      package_list_version_regex => "$(rpm_knowledge.rpm_version_regex)";
      package_list_arch_regex    => "$(rpm_knowledge.rpm_arch_regex)";

      package_patch_installed_regex => ".*Installed.*|.*Not Applicable.*";
      package_patch_name_regex    => "[^|]+\|\s+([^\s]+).*";
      package_patch_version_regex => "[^|]+\|[^|]+\|\s+([^\s]+).*";

      package_name_convention => "$(name)";
      package_add_command => "$(suse_knowledge.call_zypper) --help >/dev/null 2>&1 ; /bin/true";
      package_delete_command => "$(suse_knowledge.call_zypper) --non-interactive remove --force-resolution";
      package_update_command => "$(suse_knowledge.call_zypper) --non-interactive update";
      package_patch_command => "$(suse_knowledge.call_zypper) --non-interactive patch$"; # $ means no args
      package_verify_command => "$(suse_knowledge.call_zypper) --non-interactive verify$";
}

body copy_from inventory_cmdb_copy_from
{
    !cfe_inventory_cmdb_override_file::
      source      => "me.json";
      servers     => { "$(sys.policy_hub)" };
    cfe_inventory_cmdb_override_file::
      source      => "$(sys.inputdir)/me.json";
    any::
      compare     => "digest";
      encrypt     => "true";
      verify      => "true";
}

body classes inventory_scoped_classes_generic(scope, x)
{
      scope => "$(scope)";
      promise_repaired => { "promise_repaired_$(x)", "$(x)_repaired", "$(x)_ok", "$(x)_reached" };
      repair_failed => { "repair_failed_$(x)", "$(x)_failed", "$(x)_not_ok", "$(x)_not_kept", "$(x)_not_repaired", "$(x)_reached" };
      repair_denied => { "repair_denied_$(x)", "$(x)_denied", "$(x)_not_ok", "$(x)_not_kept", "$(x)_not_repaired", "$(x)_reached" };
      repair_timeout => { "repair_timeout_$(x)", "$(x)_timeout", "$(x)_not_ok", "$(x)_not_kept", "$(x)_not_repaired", "$(x)_reached" };
      promise_kept => { "promise_kept_$(x)", "$(x)_kept", "$(x)_ok", "$(x)_not_repaired", "$(x)_reached" };
}

body contain inventory_in_shell
{
      useshell => "true"; # canonical "useshell" but this is backwards-compatible
}