Get result "notchecked"

[bvilliot]

Hi,

When I launch a scan, I get result "notchecked" for all rules.
I run the following command :

oscap xccdf eval --results xccdf-results.xml --cpe guide-cpe-dictionary.xml guide-xccdf.xml

What can be the reasons to get results "notchecked"?

Thank you

[isimluk]

We prefer to answer questions like this on the mailing-list (http://open-scap.org/page/Maillist)

Notchecked is defined by standard (NISTIR-7275r4) as

The <xccdf:Rule> was not evaluated by the checking engine. This status is designed for <xccdf:Rule> elements that have no <xccdf:check> elements or that correspond to an unsupported checking system. It may also correspond to a status returned by a checking engine if the checking engine does not support the indicated check code.

That means that either

• XCCDF file does not specify any check for that particular rule
• OVAL file was not found
• particular id was not found in the OVAL file
• our oval interpreter cannot evaluate given rule

There may be element in your xccdf-results.xml specifying which is the case.