Prototype: accessedbefore(newer, older)

Return type: boolean

Description: Compares the atime fields of two files.

Return true if newer was accessed before older.

Arguments:

  • newer: string - Newer filename - in the range: "?(/.*)
  • older: string - Older filename - in the range: "?(/.*)

Example:

Prepare:

code
touch -a -t '200102031234.56' /tmp/earlier
touch -a -t '200202031234.56' /tmp/later

Run:

code
body common control
{
      bundlesequence  => { "example" };
}

bundle agent example
{
  classes:
      "do_it" expression => accessedbefore("/tmp/earlier","/tmp/later");

  reports:
    do_it::
      "The secret changes have been accessed after the reference time";
}

Output:

code
R: The secret changes have been accessed after the reference time

See also: changedbefore(), isnewerthan()