Syntax of the custom_probes File

The custom_probes file can contain any valid Bourne shell command, variable, or algorithm.

You can define probe and comparison functions that require a single argument in the custom_probes file. When you subsequently use the corresponding custom probe keyword in the rules file, the argument after the keyword is interpreted (as $1).

When you subsequently use the corresponding custom rule keyword in the rules file, the argument is interpreted starting after the keyword and ending before the next && or begin script, whichever comes first.

The custom_probes file must:

• Be named custom_probes

• Be owned by root

• Be executable (have its permissions set to 755)

• Contain at least one probe function and one corresponding comparison function

To improve clarity and organization, define all probe functions first, at the top of the file, followed by all comparison functions.