node-behavior

Queries behavior profile data downloaded to the Data Node through the policy synchronization module.

Command properties

Property	Description
Command type	Driver
Required permission	Administrator
License usage	Not counted
Parallel execution	Not supported
Distributed execution	Runs on Data Node (mapper)

Syntax

node-behavior [guid=STR] [name=STR]

In the syntax above, name is available starting with 4.0.2609.0.

Options

guid=STR: Behavior profile GUID. In the 5.0 series (through 5.0.2605.2), this is the only way to specify a profile. In the 4.0 series (4.0.2609.0 and later), it cannot be used together with name. When specified, queries the data for that profile. When omitted, lists all behavior profiles.
name=STR: Behavior profile name (cannot be used together with guid). When specified, queries the data for that profile. When omitted, lists all behavior profiles. This option is available starting with 4.0.2609.0.

Output fields

When both the guid and name options are omitted (profile list):

Field	Type	Description
`id`	integer	Behavior profile ID
`guid`	string	Behavior profile GUID
`name`	string	Behavior profile name
`description`	string	Behavior profile description
`rows`	long	Number of profile records
`curr_ver`	long	Current build version
`schedule`	string	Build schedule
`key_fields`	array	List of key fields
`query`	string	Profile build query
`created`	timestamp	Creation time
`updated`	timestamp	Last modification time

When either the guid or name option is specified (profile data query):

Field	Type	Description
Key fields	-	Key fields defined in the behavior profile. Varies by profile.

Error codes

Parse errors

Error code	Message	Description
300350	no permission for node-behavior	Executed from a session without administrator privileges.
300351	invalid guid format for node-behavior	The `guid` option value is not a valid GUID format.
300352	behavior [guid] not found for node-behavior	No behavior profile exists for the specified GUID.
300353	Behavior profile not found by name for node-behavior.	No behavior profile exists with the name specified in the `name` option. Available starting with 4.0.2609.0, which has the `name` option.
300354	Duplicate behavior profile name for node-behavior.	More than one behavior profile exists with the name specified in the `name` option. Available starting with 4.0.2609.0, which has the `name` option.
300355	Specify only one of 'guid' or 'name' option in the node-behavior command.	Both the `guid` and `name` options are specified. Available starting with 4.0.2609.0, which has the `name` option.
300356	Cannot load behavior profile for node-behavior.	An error occurred while reading the behavior profile data. Available starting with 4.0.2609.0.

Runtime errors

None

Description

The node-behavior command queries behavior profile data deployed to the Data Node from the Control Node through policy synchronization.

When both the guid and name options are omitted, it lists the metadata of all behavior profiles synchronized to the Data Node. When either the guid or name option is specified, it queries the individual data records stored in that profile. The output fields of profile data vary depending on the key fields defined in each behavior profile.

In the 4.0 series (4.0.2609.0 and later), you can use the name option to specify a behavior profile by name instead of GUID. Specifying both options at the same time causes an error, as does specifying a name that does not exist or that matches more than one profile.

This command runs on the Data Node, so it is used to verify the status of behavior profile data synchronized to the Data Node.

Examples

List behavior profiles
```
node-behavior
```
Queries the metadata of all behavior profiles synchronized to the Data Node.
Query data for a specific behavior profile
```
node-behavior guid=550e8400-e29b-41d4-a716-446655440000
```
Queries the data stored in the behavior profile with the specified GUID.
Query behavior profile data by name (4.0 series, 4.0.2609.0 and later)
```
node-behavior name=web_attacker_profile
```
Queries the data stored in the behavior profile with the specified name.

Change history

Target	Introduced in
The `node-behavior` command	Before Sonar 4.0
The `name` option	4.0.2609.0