Accuracy of Remediated Computer Results?

(imported topic written by jnmoore91)

Hi All,

So usually, when I want to fetch the remediated computers of a fixlet, I use

results whose (NOT relevant flag of it AND exists last became relevant of it) of it

, and the relevance query makes sense, so I didn’t question it, however, I was looking at one of the custom reports posted on the forum by a bigFix developer (I think it was labeled mspatch-subtotal), and the developer used

results whose (exists last became relevant of it AND exists last became nonrelevant of it AND last became relevant of it < last became nonrelevant of it) of it. Both seem like very logical queries that will give you a list of remediated results, but I wanted to make sure they results didn’t differ, so I made the following query and executed it on the QNA page of web reports:

(

(item 0 of it as floating point / item 1 of it * 100) as string & “%25”,

item 0 of it,

item 1 of it,

item 2 of it

) of (

(if(item 0 of it > item 1 of it)

then (item 1 of it, item 0 of it, item 2 of it)

else (item 0 of it, item 1 of it, item 2 of it)

)

) of (

number of results whose (

exists last became relevant of it AND

exists last became nonrelevant of it AND

last became relevant of it < last became nonrelevant of it

) of it,

number of results whose(

NOT relevant flag of it AND

exists last became relevant of it

) of it,

name of it

) of bes fixlets whose (

exists results whose (

exists last became relevant of it AND

exists last became nonrelevant of it AND

last became relevant of it < last became nonrelevant of it

) of it AND

exists results whose(

NOT relevant flag of it AND

exists last became relevant of it

) of it AND

(

number of results whose (

exists last became relevant of it AND

exists last became nonrelevant of it AND

last became relevant of it < last became nonrelevant of it

) of it

) is not (

number of results whose(

NOT relevant flag of it AND

exists last became relevant of it

) of it

)

)

I got a list of about 450 computers whose results were different (I deleted the names of the fixlets).

the % represents the accuracy (closer to 100% the better), and the second and third numbers represents the numbers of the different results.

So my question is, which is more accurate? Which relevance query should I be using for remediated computer results?

99.99%, 9639, 9640,
80%, 3, 4,
24%, 6, 25,
24%, 6, 25,
24%, 6, 25,
24%, 6, 25,
24%, 6, 25,
24%, 6, 25,
24%, 6, 25,
24%, 6, 25,
92%, 12, 13,
24%, 6, 25,
96.95%, 7124, 7348,
24%, 6, 25,
97.85%, 5419, 5538,
83.78%, 1116, 1332,
99.995%, 19454, 19455,
99.5%, 621, 624,
99.878%, 13942, 13959,
99.973%, 48069, 48082,
80%, 5, 6,
99.2%, 126, 127,
99.987%, 15349, 15351,
99.979%, 32674, 32681,
99.8%, 608, 609,
98%, 39, 40,
97.69%, 4994, 5112,
98.5%, 391, 397,
98%, 47, 48,
94%, 51, 54,
94%, 33, 35,
98.970%, 13843, 13987,
83%, 15, 18,
85%, 47, 55,
99.97%, 3531, 3532,
70%, 2, 3,
94%, 34, 36,
29.8%, 42, 141,
31.7%, 46, 145,
32%, 9, 28,
30.0%, 42, 140,
98%, 56, 57,
99.5%, 571, 574,
29.8%, 42, 141,
29.8%, 42, 141,
24%, 6, 25,
83%, 39, 47,
98%, 53, 54,
99.998%, 58828, 58829,
83%, 10, 12,
98.4%, 121, 123,
99.996%, 22962, 22963,
99.2%, 350, 353,
97.8%, 583, 596,
44.1%, 64, 145,
99.6%, 248, 249,
58.3%, 105, 180,
30.0%, 42, 140,
30.0%, 42, 140,
30.0%, 42, 140,
98.3%, 347, 353,
30%, 16, 53,
30.0%, 42, 140,
96.36%, 2039, 2116,
99.2%, 258, 260,
47.1%, 72, 153,
44.1%, 64, 145,
44.1%, 64, 145,
99.56%, 2461, 2472,
99.997%, 58377, 58379,
97%, 74, 76,
67.6%, 169, 250,
83.0%, 156, 188,
99.8%, 513, 514,
88%, 30, 34,
99.7%, 944, 947,
99.995%, 18994, 18995,
99.85%, 1987, 1990,
99.93%, 4495, 4498,
27.1%, 67, 247,
99.749%, 63971, 64132,
99.8%, 511, 512,
99.910%, 36743, 36776,
96.0%, 145, 151,
99.993%, 13524, 13525,
99.972%, 75453, 75474,
96%, 50, 52,
99.5%, 410, 412,
92%, 12, 13,
44.1%, 64, 145,
99.92%, 5921, 5926,
99.998%, 59136, 59137,
99.987%, 39856, 39861,
69.6%, 94, 135,
99.22%, 1533, 1545,
42%, 10, 24,
99.7%, 339, 340,
99.6%, 261, 262,
99.85%, 1327, 1329,
99.975%, 23526, 23532,
99.960%, 34899, 34913,
99.5%, 189, 190,
99.76%, 7801, 7820,
44.1%, 64, 145,
99.858%, 21125, 21155,
99.81%, 1060, 1062,
92.52%, 1249, 1350,
44.1%, 64, 145,
99.956%, 68567, 68597,
73.4%, 124, 169,
99.975%, 67786, 67803,
99.952%, 27274, 27287,
99.991%, 75396, 75403,
88.7%, 219, 247,
99.990%, 20753, 20755,
99.4%, 158, 159,
99.5%, 209, 210,
96.1%, 816, 849,
99.752%, 63924, 64083,
44.1%, 64, 145,
98.3%, 298, 303,
99.7%, 290, 291,
48.6%, 72, 148,
87.7%, 400, 456,
88.9%, 144, 162,
96.6%, 252, 261,
99.85%, 2599, 2603,
99.88%, 1642, 1644,
92.7%, 656, 708,
91.9%, 203, 221,
97.1%, 268, 276,
99.96%, 2789, 2790,
97.74%, 5978, 6116,
52.2%, 83, 159,
52.2%, 83, 159,
52.2%, 83, 159,
99.91%, 3526, 3529,
95.09%, 7071, 7436,
53%, 10, 19,
99.39%, 3435, 3456,
99.1%, 998, 1007,
98.74%, 4299, 4354,
96.0%, 436, 454,
98.9%, 185, 187,
99.5%, 220, 221,
99.49%, 2144, 2155,
99.90%, 1908, 1910,
97%, 59, 61,
99.0%, 990, 1000,
47.0%, 71, 151,
97.39%, 1194, 1226,
43.1%, 56, 130,
61.3%, 122, 199,
99.82%, 5003, 5012,
99.82%, 3419, 3425,
96.7%, 579, 599,
51.8%, 58, 112,
99.77%, 1755, 1759,
99.952%, 68758, 68791,
99.980%, 85901, 85918,
99.992%, 79801, 79807,
43.1%, 56, 130,
58.9%, 96, 163,
45.5%, 65, 143,
94.4%, 671, 711,
42%, 43, 103,
36%, 4, 11,
93.4%, 824, 882,
36%, 4, 11,
36.5%, 42, 115,
49%, 24, 49,
8.0%, 17, 213,
7.9%, 17, 214,
7.8%, 17, 219,
99.86%, 5008, 5015,
99.4%, 164, 165,
99%, 79, 80,
99.72%, 1074, 1077,
98.63%, 7549, 7654,
98.6%, 141, 143,
98.3%, 119, 121,
98.7%, 299, 303,
99.8%, 837, 839,
99.7%, 348, 349,
99.84%, 1277, 1279,
98.4%, 941, 956,
80%, 3, 4,
78%, 57, 73,
99.995%, 85965, 85969,
27.1%, 67, 247,
99.997%, 85963, 85966,
98%, 54, 55,
98.9%, 175, 177,
29.6%, 61, 206,
97.61%, 5188, 5315,
29.6%, 61, 206,
98.163%, 15764, 16059,
90.6%, 607, 670,
96.51%, 3097, 3209,
96%, 87, 91,
99.7%, 695, 697,
99.653%, 20118, 20188,
8.5%, 17, 200,
99.4%, 174, 175,
99.1%, 229, 231,
99.2%, 125, 126,
96%, 26, 27,
28.4%, 67, 236,
99.96%, 2281, 2282,
99.98%, 5154, 5155,
99.7%, 357, 358,
97.1%, 849, 874,
28.3%, 67, 237,
28.3%, 67, 237,
19%, 6, 32,
29.1%, 67, 230,
47%, 8, 17,
44%, 7, 16,
64%, 7, 11,
99.94%, 6862, 6866,
98%, 61, 62,
88.7%, 478, 539,
99.83%, 6275, 6286,
97.8%, 133, 136,
88%, 51, 58,
99.3%, 135, 136,
96.30%, 4377, 4545,
99.960%, 79146, 79178,
99.947%, 22498, 22510,
97%, 36, 37,
97.125%, 15101, 15548,
97.085%, 15154, 15609,
64%, 9, 14,
87.7%, 407, 464,
97.7%, 130, 133,
96%, 22, 23,
94.8%, 560, 591,
97.26%, 1384, 1423,
94.7%, 230, 243,
84.1%, 280, 333,
97.7%, 130, 133,
97.8%, 133, 136,
97.8%, 133, 136,
97.7%, 130, 133,
97.8%, 133, 136,
99%, 94, 95,
53%, 10, 19,
46.6%, 62, 133,
95.8%, 479, 500,
99.8%, 664, 665,
50%, 9, 18,
50%, 9, 18,
50%, 9, 18,
50%, 9, 18,
53%, 9, 17,
53%, 9, 17,
53%, 9, 17,
53%, 9, 17,
53%, 9, 17,
53%, 9, 17,
53%, 9, 17,
53%, 9, 17,
53%, 9, 17,
53%, 9, 17,
53%, 9, 17,
53%, 9, 17,
53%, 9, 17,
97.8%, 133, 136,
53%, 9, 17,
53%, 9, 17,
33%, 6, 18,
99.93%, 4188, 4191,
53%, 9, 17,
15.9%, 17, 107,
97%, 72, 74,
43.3%, 52, 120,
99.6%, 224, 225,
99.7%, 286, 287,
96%, 22, 23,
97%, 72, 74,
97%, 71, 73,
53%, 8, 15,
18%, 17, 93,
99.96%, 2594, 2595,
99.94%, 7076, 7080,
43.3%, 58, 134,
97%, 62, 64,
99.62%, 1052, 1056,
99.5%, 622, 625,
97.8%, 133, 136,
90.71%, 2500, 2756,
99%, 75, 76,
60%, 5, 9,
99.7%, 383, 384,
49%, 35, 71,
97.849%, 15054, 15385,
70%, 5, 7,
70%, 5, 7,
97.851%, 15068, 15399,
97.943%, 14997, 15312,
70%, 5, 7,
98.031%, 14985, 15286,
70%, 5, 7,
48%, 39, 81,
99.996%, 56455, 56457,
50%, 33, 66,
99.93%, 2905, 2907,
99.277%, 13864, 13965,
70%, 4, 6,
47%, 18, 38,
31%, 9, 29,
29%, 8, 28,
98%, 47, 48,
98.1%, 463, 472,
95.7%, 199, 208,
95%, 37, 39,
98.2%, 112, 114,
98%, 41, 42,
99.4%, 172, 173,
99.4%, 173, 174,
98.7%, 373, 378,
99.4%, 164, 165,
99.1%, 734, 741,
99.6%, 271, 272,
98%, 90, 92,
99.88%, 1630, 1632,
99.89%, 1883, 1885,
99.90%, 2095, 2097,
98%, 39, 40,
98%, 39, 40,
99.9%, 931, 932,
99.7%, 608, 610,
99.8%, 457, 458,
98.7%, 223, 226,
99.90%, 2034, 2036,
99.95%, 2066, 2067,
98.22%, 1215, 1237,
96.46%, 1170, 1213,
98%, 50, 51,
94%, 80, 85,
99.86%, 1431, 1433,
97%, 33, 34,
99.79%, 2804, 2810,
99.78%, 2746, 2752,
94%, 30, 32,
98.0%, 480, 490,
99.8%, 485, 486,
99.95%, 2085, 2086,
97.22%, 3842, 3952,
97.75%, 1215, 1243,
98%, 47, 48,
99.6%, 240, 241,
98.4%, 185, 188,
96%, 51, 53,
98.2%, 760, 774,
90%, 6, 7,
99.6%, 485, 487,
95%, 59, 62,
98.6%, 554, 562,
98.2%, 852, 868,
99.6%, 226, 227,
99.4%, 631, 635,
99.30%, 4696, 4729,
99.81%, 3205, 3211,
97%, 33, 34,
99.65%, 1976, 1983,
94%, 30, 32,
98.2%, 280, 285,
98.6%, 936, 949,
96.9%, 286, 295,
96%, 65, 68,
98%, 42, 43,
98.6%, 140, 142,
97.6%, 161, 165,
98.2%, 658, 670,
98.5%, 868, 881,
97.9%, 939, 959,
99.12%, 1239, 1250,
97.1%, 505, 520,
99.80%, 2034, 2038,
97%, 31, 32,
99.7%, 394, 395,
99.80%, 1473, 1476,
98.3%, 398, 405,
99.7%, 319, 320,
99.6%, 273, 274,
98.9%, 358, 362,
97.5%, 199, 204,
99.85%, 5242, 5250,
95%, 40, 42,
98.51%, 3714, 3770,
98.0%, 923, 942,
98.3%, 650, 661,
99.2%, 124, 125,
99.98%, 6321, 6322,
99.988%, 52113, 52119,
99.2%, 117, 118,
99.34%, 1359, 1368,
99.14%, 7289, 7352,
98.54%, 1219, 1237,
99.87%, 6948, 6957,
98%, 45, 46,
98.95%, 5299, 5355,
98.53%, 1210, 1228,
99.22%, 1143, 1152,
99.1%, 110, 111,
99.85%, 6058, 6067,
98%, 40, 41,
98.87%, 4811, 4866,
97.6%, 745, 763,
99.21%, 1125, 1134,
99.8%, 599, 600,
99.3%, 141, 142,
99.992%, 12366, 12367,
99.94%, 6999, 7003,
98%, 43, 44,
99.975%, 62986, 63002,
99.70%, 7398, 7420,
99.78%, 4518, 4528,
99.81%, 1573, 1576,
99.97%, 2983, 2984,
99.997%, 35594, 35595,
99.994%, 16714, 16715,
99.98%, 9214, 9216,
99.997%, 72579, 72581,
99.75%, 8647, 8669,
99.81%, 5350, 5360,
99.83%, 1729, 1732,
99.96%, 10387, 10391,
99.7%, 370, 371,
99.990%, 71692, 71699,
99.73%, 7998, 8020,
99.81%, 5212, 5222,
99.82%, 1640, 1643,
99.98%, 9250, 9252,
99.97%, 8643, 8646,
99.977%, 74331, 74348,
92%, 57, 62,
98%, 44, 45,
99.89%, 1779, 1781,
99.94%, 5122, 5125,
90%, 44, 49,
99.1%, 116, 117,
98%, 57, 58,
99.944%, 53156, 53186,
99.93%, 4358, 4361,
99.90%, 3056, 3059,
99.94%, 6854, 6858,
96%, 53, 55,
97%, 36, 37,
99.5%, 186, 187,
99.0%, 307, 310,
98.67%, 3777, 3828,
99.5%, 190, 191,
85.5%, 278, 325,
89%, 80, 90,
98.5%, 383, 389,
99.98%, 9578, 9580,
99.978%, 32033, 32040,
99.995%, 56104, 56107,
99.998%, 47076, 47077,

(imported comment written by jnmoore91)

Hi All,

Just a follow up on this thread, since no one else has any input.

Based on the data supplied by BigFix’s SingleFixletReport, the correct method to fetch remediated computers is to use

names of computers of results whose(not relevant flag of it) of bes fixlet whose (…)

. The two relevance queries above do not provide the same results as the Single Fixlet Report.

–Jerroyd

(imported comment written by BenKus)

Hey Jerroyd,

Very clever query and nicely done…

I believe these two expressions you have are logically equivalent, but your specific deployment probably has two issues that cause the discrepency:

  1. There seems to be 1-5 computers that have inconsistent Fixlet report data… These seem to be the cause of the 99.9%+ queries… This issue might have been caused by some issue that affected a computer since your system has started…

  2. You run a very large deployment and I am guessing that you guys use a special web reports optimization where you remove old Fixlet results to keep the web reports running smoothly without needing to load the long history of Fixlets results. If you check only for results in the last 6 months (or whatever your BES Admin set the optimization setting to, then you shouldn’t see any discrepancies).

Use this query to find the computers (note that they might be computers reporting no names or other errors):

(id of it, (if (exist name of it) then name of it else “”)) of elements of set of computers of results whose ((not relevant flag of it AND exists last became relevant of it) AND not (exists last became relevant of it AND exists last became nonrelevant of it AND last became relevant of it < last became nonrelevant of it)) of bes fixlets

Ben