Automate removal of expired and stopped action

Usage and Config
1

HI All,

Is there a way to automate deletion of expired and stopped action from the console?

Best Regards,
Braian

2

We don’t currently provide any tools/utilities to do this, but it can certainly be done via the REST API (see delete method for action{action id} referenced here https://developer.bigfix.com/rest-api/api/action.html). I might have a sample Fixlet that does this before long that I’d be willing to share.

1 Like
3

Hi Aram,

Can you share sample fixlet that I can used as reference?

Thank You.

best regards,
Braian

4

Certainly, but it will take me a bit of time (I haven’t put it together just yet). I will follow up with a link here once ready.

5

Here is how you get the ID of all actions that are stopped or expired using session relevance:

(id of it, name of it) of bes actions whose("Open" != state of it)

Reference: https://support.bigfix.com/inspectors/Session%20Objects_Any.html

To stop an action, you send an HTTP POST to the following REST API URL:

https://root:port/api/action/{action id}/stop

You can also delete an action using the REST API:

Reference: https://developer.bigfix.com/rest-api/api/action.html

2 Likes
6

This is not what you were looking for, but is very related:

It is a dashboard that looks for open actions that are targeted at specific endpoints that are not policy actions and all computers have finished running it. This basically means the action will no longer have further effects in the system, so they can be stopped, and it provides a mechanism for stopping all or some of them.

This same concept could be adapted for deleting all stopped or expired actions, or deleting all stopped or expired actions older than X days, since it is nice to maintain SOME history.

I would not recommend deleting ALL stopped or expired actions in case you need to review them later.