accessedbefore

Table of Contents

Prototype: accessedbefore(newer, older)

Return type: boolean

Description: Compares the atime fields of two files.

Return true if newer was accessed before older.

Arguments:

  • newer: string, in the range: "?(/.*)
  • older: string, in the range: "?(/.*)

Example:

Prepare:

touch -a -t '200102031234.56' /tmp/earlier
touch -a -t '200202031234.56' /tmp/later

Run:

body common control
{
      bundlesequence  => { "example" };
}

bundle agent example
{
  classes:
      "do_it" expression => accessedbefore("/tmp/earlier","/tmp/later");

  reports:
    do_it::
      "The secret changes have been accessed after the reference time";
}

Output:

R: The secret changes have been accessed after the reference time