Data Collection shows Non-existent items found

Products

• Control Compliance Suite Standards Database
• Control Compliance Suite
• Control Compliance Suite Standards Server

Issue/Introduction

The Symantec CCS has the following Evidence:

Object Name: /file/doesnot/exist | User: 11122233
Object Type: Files
Expression: Deleted user '11122233' should not be owner of files or directories on the system.
Current Value: /file/doesnot/exist

While the file does not exist on the server when we search on the server with: 

ls -l /file/doesnot/exist

 

Cause

File was there during data collection but removed shortly afterwards.

Resolution

After running the job again to get verbose logs, CCS is no longer reporting on that non-existent item.

File most likely was there during data collection but was removed not long after/prior to checking on the file.

No follow up job was run at that time to see if CCS would still report on that file.

After running the data collection job again, verified the previous data is no longer showing up.

CCS is reporting correctly.