Thanks for reply, Watson…

I’m using the SCAP contents from the OVAL CIS repository.

And, yes I have already tried on a Linux box and the performance over there is 
much better.

Bharath M

From: Watson Sato <>
Sent: Thursday, December 20, 2018 9:06 PM
To: Mohanraj, Bharath <>
Subject: Re: [Open-scap] OVAL evaluation of individual definitions

On Wed, Nov 28, 2018 at 11:47 PM Mohanraj, Bharath 
<<>> wrote:
Hi Team,

I'm evaluating oscap 1.3.0 on windows, and I have a query on the same.

I'm trying to evaluate definitions on a Win 10 box and I see that the operation 
takes 1-3 minutes for each definitions. There are cases where some xmls have 
thousands of definitions. So, this really is a time consuming process.

Depending on what the rule is checking for, it can really take a few minutes.
I'm interested to know what contents are you using. Where you sourcing the SCAP 
contents from, or are you using your own?

I also tried --id and perform evaluation of definitions one after other. I 
don't see much improvement here as well.

I also tried parallel evaluation with multiple oscap process working on 
different definitions. This again didn't help.

I also tried --skip-valid swich, which again saved only 15-20secs of time.

Is there any to other way to achieve better performance? Please guide me.
It could be that oscap is performing poorly on windows, or it could be that the 
checks are really big.
If possible, it would be interesting to run similar checks on a linux box and 
see if it performs similarly.


Bharath M

Open-scap-list mailing list<><>

Watson Sato
Security Technologies | Red Hat, Inc
Open-scap-list mailing list

Reply via email to