All Endpoints stop updating for a specific time of the day. 2 hours everyday at same time. No Backup was running or security scan. DB connection was working fine it is just no updating the DB. Is there some logs from Bigfix to check where is the choke point during that time? Endpoint - relay -Main server connection/reporting was fine when checking logs.
Might this happen to be around midnight per the Root Serverâs timezone?
Iâd recommend turning on the FillDB Performance log perhaps 3-4 hours before and after the specific time of day in question. Do be careful with the log however as it can grow in size relatively quickly.
We had an issue like that where clients would stop checking in around 6 am each day. Turns out we share qos with over-the-wire daily backups. One of our PCI teams went from incremental to full backups at 6 am which basically pushed out all other traffic, with UDP being the lowest priority. Everything picks up again like normal once the daily backups complete.
This doesnât appear to be the Performance log, but in any case, if this is occurring consistently at midnight, I would suggest it is more than likely related to FillDBâs Historical Counts process. Please see https://bigfix-wiki.hcltechsw.com/wikis/home?lang=en-us#!/wiki/BigFix%20Wiki/page/Troubleshooting%20FillDB%20Operations for more information, but essentially, once a day, FillDB performs some work to count the total number of relevant Fixlets by severity (and total computer count) for use in some specific Web Reports. You can disable this process with the following setting:
Thanks for the info.We will try that option. I just want to add that if we restart SQL service all endpoints reports fine. And if we do not touch anything it will be auto-correct after 3 hours.
The UpdateHistoricalCounts setting controls the execution of update_historical_counts database procedure: configuring it to 0, you are going to disable the procedure.
This procedure inserts data into BFEnterprise tables HISTORICAL_FIXLET_COUNTS, for the historical information about the number of Fixlets at different severity levels, and HISTORICAL_COMPUTER_COUNTS, for the information about historical computer count objects.
The data from these tables are taken by a couple of session relevance inspectors, runnable from WebReports QNA: âall fixlet countâ and âall computer countâ.
For this reason, if you have any custom report based one of the two inspectors, you wonât see the report data to change and to get updated but you will keep seeing the data collected until you set the UpdateHistoricalCounts to 0.
Itâs not a configurable option to specify the schedule, no. Is there a different time of day you would have preferred it to run? Or perhaps on a weekly rather than daily basis?