I have an analysis that is parsing some output text files for specific results. Overall the analysis properties are working and I’m getting the results that I anticipate with the exception of a smaller portion of my environment where the properties return ‘none’ as the result. This result is incorrect as the files the analysis is parsing do exist on the endpoints (I checked a sampling) and contain the expected values that I’m looking to have reported in the analysis. Is there any reason why ‘none’ would appear instead?
How often is the property configured to be evaluated (is it possible the file contents changed or were added after it last evaluated and reported)? If you query the device with the same relevance, but via Fixlet Debugger’s Query Channel option, or via BigFix Query, do you get the expected result? If so, consider sending a refresh to one of the devices in question to see if the value is updated properly.
Alternatively, is it possible that wow64 redirection is affecting things here?
The property is evaluated every 30 minutes and the files being parsed are updated every 30 minutes.
If I use Query to test the Property relevance against a sampling of computers showing ‘none’ in the analysis, all six properties return the expected correct results.
The files being parsed are in c:\temp, so wow64 isn’t a factor.
@JonL Hope you enjoyed the stickers.
I suspect you are hitting a timing issue, where the analysis checks before the file exists, or the contents have been updated, and so gives a None, and then after the None report, the file is updated or instantiated.
I wonder if you could use some additional relevance wrapping / Error Trapping to get more information about the situation at evaluation time?
q: if (exists "Main relevance that usually works") whose (it as string != "" and it as string != "none") then ("main relevance") else (if (exists file "c:\test\file.txt") then (if (exists line whose (exists"something") of file "c:\test\file.txt") then ("Some Other Deeper Testing") else ("Line Missing" & concatenation "|" of lines of file "c:\test\file.txt") ) else ("File missing - " & concatenation "|" of names of files of folder "c:\test"))
@brolly33 I did enjoy the stickers, thanks! Its not everyday that I get an autographed one!
For reference, here is the relevance of the property that I’m working on. It works in 80%+ of my clients, but not for others.
if (exists locked lines whose (it contains "Failed to connect" | "FTC") of files "c:\temp\TLS_Validation.txt") then "Failed to connect" else if (exists locked lines whose (it contains "certificate has expired" | "CE") of files "c:\temp\TLS_Validation.txt") then "certificate has expired" else if (exists locked lines whose (it contains "Could not resolve host" | "host") of files "c:\temp\TLS_Validation.txt") then "Could not resolve host" else (substrings after "< " of locked lines whose (it starts with "< HTTP/" | "http") of files "c:\temp\TLS_Validation.txt")
I was thinking that using ‘locked lines’ would avoid any timing of the file being updated, but I could be wrong.
I see what you’re trying to do with the error trapping but having some challenges shoe-horning it into my situation. This is my attempt.
q: if (if (exists locked lines whose (it contains "Failed to connect" | "FTC") of files "c:\temp\TLS_Validation.txt") then "Failed to connect" else if (exists locked lines whose (it contains "certificate has expired" | "CE") of files "c:\temp\TLS_Validation.txt") then "certificate has expired" else if (exists locked lines whose (it contains "Could not resolve host" | "host") of files "c:\temp\TLS_Validation.txt") then "Could not resolve host" else (substrings after "< " of locked lines whose (it starts with "< HTTP/" | "http") of files "c:\temp\TLS_Validation.txt")) whose (it as string != "" and it as string != "none") then (if (exists locked lines whose (it contains "Failed to connect" | "FTC") of files "c:\temp\TLS_Validation.txt") then "Failed to connect" else if (exists locked lines whose (it contains "certificate has expired" | "CE") of files "c:\temp\TLS_Validation.txt") then "certificate has expired" else if (exists locked lines whose (it contains "Could not resolve host" | "host") of files "c:\temp\TLS_Validation.txt") then "Could not resolve host" else (substrings after "< " of locked lines whose (it starts with "< HTTP/" | "http") of files "c:\temp\TLS_Validation.txt")) else (if (exists file "c:\temp\TLS_Validation.txt") then (if (exists line whose (exists "Failed to connect") of file "c:\temp\TLS_Validation.txt") then ("Some Other Deeper Testing") else ("Line Missing" & concatenation "|" of lines of file "c:\temp\TLS_Validation.txt") ) else ("File missing - " & concatenation "|" of names of files whose (name of it starts with "TLS_Validation") of folder "c:\temp"))
E: A boolean expression is required.
OK. I am going to pivot a little and instead of nesting if then else, I am going to take advantage of the pipe and cascade my errors in reverse off the end of your existing (and add a little now as string to give a sense of “when”)
(if (exists locked lines whose (it contains "Failed to connect" | "FTC") of files "c:\temp\TLS_Validation.txt") then "Failed to connect" else if (exists locked lines whose (it contains "certificate has expired" | "CE") of files "c:\temp\TLS_Validation.txt") then "certificate has expired" else if (exists locked lines whose (it contains "Could not resolve host" | "host") of files "c:\temp\TLS_Validation.txt") then "Could not resolve host" else (concatenation "|" of substrings after "< " of locked lines whose (it starts with "< HTTP/" | "http") of file "c:\temp\TLS_Validation.txt"))|(now as string & concatenation "|" of locked lines of file "c:\temp\TLS_Validation.txt" )|(now as string & concatenation " | " of pathnames of files of folder "c:\temp")|(now as string & concatenation of names of folders of folders "c:\" )
Oh. hmmm. Are you using | as an OR as in many languages? Pipe catches an error in relevance.
q: error "bob"|"not bob"
A: not bob
Try this one?
(if (exists locked lines whose (it contains "Failed to connect" or it contains "FTC") of files "c:\temp\TLS_Validation.txt") then "Failed to connect" else if (exists locked lines whose (it contains "certificate has expired" or it contains "CE") of files "c:\temp\TLS_Validation.txt") then "certificate has expired" else if (exists locked lines whose (it contains "Could not resolve host" OR it contains "host") of files "c:\temp\TLS_Validation.txt") then "Could not resolve host" else (concatenation "|" of substrings after "< " of locked lines whose (it starts with "< HTTP/" | "http") of file "c:\temp\TLS_Validation.txt"))|(now as string & concatenation "|" of locked lines of file "c:\temp\TLS_Validation.txt" )|(now as string & concatenation " | " of pathnames of files of folder "c:\temp")|(now as string & concatenation of names of folders of folders "c:\" )
@brolly33 I added a property I called ‘brolly’ in your honor to my analysis using your syntax. Since this functionally mirrors my own property, I wanted to compare the results.
Interestingly, the computers that show ‘none’ for 6 other properties of similar type in the analysis did show the correct result when using your format.
About a quarter of the responding computers show ‘error’ as the result. Mouse over shows ‘…’ without an actual error message. Web reports doesn’t show any more detail to the error.
None of them are showing your alternative results like file contents or folder listing. It seems that trapping the whole relevance statement did something. However it didn’t work universally. I’m trying to wrap my head around what exactly its doing and why.
1 Like
OK - next troubleshooting trick.
for each thing that could go wrong, add a property to your analysis to test just that thing.
now
exists folder "c:\temp"
exists file "TLS_Validation.txt" of folder "c:\temp"
number of locked lines of file "TLS_Validation.txt" of folder "c:\temp"
locked lines of file "TLS_Validation.txt" of folder "c:\temp"
now
This should give you all of the analytics to help understand when your property gives a blank or a weird error.
Notice I created two properties with now just to see how long the entire analysis takes to process and to get a sense of when it was evaluated.
Don’t leave these around forever, as now is always changing and quite “noisy” upstream to the relays and fillDB and console performance.
@brolly33 I found via your technique that the recurring policy action that generates the data definitely can tramp on the analysis that is trying to report on that data.
In this instance, the analysis attempted to read the file 00:00:07 seconds before the policy action finished running.
Can you recommend a way to eliminate the race condition?
1 Like
The most straightforward is for your action to save its output to a temporary file, and then replace the output file with the temporary file at the very end.
1 Like