Audit trail

1

(imported topic written by EspenD91)

Hi group!

We are frequently deleting expired actions to get good performance. Our BES-server is running fine on vmware, but we seem to hit some performance thresholds quite a bit earlier than expected (compared to the figures mentioned in the BES Health Checks Analysis).

I would like to keep an audit trail even for deleted actions, without “undeleting”. By connecting to the BES-database I find most of the information we need for writing a simple webapp listing all the actions for å given computer. ( I don’t really care if they are visible in the console or not).

My problem is to find/figure out the mapping between ComputerID and the Computers hostname. Any ideas?

Regards,

Espen Dahl

Norway

2

(imported comment written by Aram_Eblighatian)

Hi Espen,

While we don’t typically recommend direct queries against the database (especially table queries rather than the documented views - http://support.bigfix.com/download/bes/misc/BESDatabaseAPIReference-7.0.pdf), the below process should likely work for you:

  • download and run (periodically) the PropertyIDMapper: http://forum.bigfix.com/viewtopic.php?pid=13604#p13604

  • once the PropertyIDMap table exists, you can run a query like the below to provide a map of ComputerIDs to Computer hostnames:

    select ComputerID, ResultsText as
    ’Computer Name’ from QUESTIONRESULTS QR where (QR.SiteID = (select SiteID from PROPERTYIDMAP where propertyname like
    ’Computer Name’)) AND (QR.AnalysisID = (select AnalysisID from PROPERTYIDMAP where propertyname like
    ’Computer Name’)) AND (QR.PropertyID = (select PropertyID from PROPERTYIDMAP where propertyname like
    ’Computer Name’))

Note that the above query will return all computers in the database (viewable in the BigFix Console or not).

3

(imported comment written by EspenD91)

Thank you, that worked great! We now have a simple webapp giving us easy access to all previous actions.

Espen, Norway