Skip to main content
Solved

Extension attribute not displaying stdout

  • May 12, 2016
  • 3 replies
  • 31 views

Forum|alt.badge.img+3

I have a simple extension attribute that's supposed to display an Agent version:

#!/bin/bash

# Check to see if the SentinelOne agent is installed.
# If the agent is installed, report the agent
# version.

printf '<result>'
if result=`/usr/local/bin/sentinelctl version | awk '{print $2 $3}'`; then
  printf "$result"
else
  printf "Unavailable/Not Installed"
fi
printf '</result>'

When I run this locally on my machine, it works, but running it as an extension attribute doesn't seem to work.

Any suggestions on how to debug this issue?

Best answer by hkabik

Try:

#!/bin/bash

# Check to see if the SentinelOne agent is installed.
# If the agent is installed, report the agent
# version.

if [ -f "/usr/local/bin/sentinelctl" ] ; then 
    RESULT=$( /usr/local/bin/sentinelctl version | awk '{print $2 $3}' )
else
    RESULT="not installed"
fi

echo "<result>$RESULT</result>"

3 replies

Forum|alt.badge.img+3
  • Author
  • New Contributor
  • May 12, 2016

I also tried:

#!/bin/bash

# Check to see if the SentinelOne agent is installed.
# If the agent is installed, report the agent
# version.

if [ -f "/usr/local/bin/sentinelctl" ] ; then 
    RESULT=`sudo /usr/local/bin/sentinelctl version | awk '{print $2 $3}'`
else
    RESULT="not installed"
fi

echo "<result>$RESULT</result>"

Just to see what happens :)


Forum|alt.badge.img+16
  • Honored Contributor
  • Answer
  • May 12, 2016

Try:

#!/bin/bash

# Check to see if the SentinelOne agent is installed.
# If the agent is installed, report the agent
# version.

if [ -f "/usr/local/bin/sentinelctl" ] ; then 
    RESULT=$( /usr/local/bin/sentinelctl version | awk '{print $2 $3}' )
else
    RESULT="not installed"
fi

echo "<result>$RESULT</result>"

Forum|alt.badge.img+3
  • Author
  • New Contributor
  • May 13, 2016

Super weird. It works when running script via Policy, but as an extension attribute, it does not.

edit: flushPolicyHistory fixed it.