Automatic Computer group last report time

1

I need to create an Automatic computer group that the last report time is less than 30 days.

A relevance expression would be great.

2 
last report time of client > now - 30*day
3

@egarduno & @jjusmc

This is unlikely to do what you expect.

Remember that the Agent itself performs all the work and has to perform the Relevance Evaluation and determine if it should “report itself” as being a member of the group or not. You’re query seems to assume that the server has some role in adding a Computer to a group. It does not.

Since what you are looking for are machines that are NOT reporting, they can’t report that they are not reporting … do you see the break in the process?

You can do something similar with Session Relevance in the Web Reports environment, but you can’t have machines report themselves as “Not Reporting”. You can only generate a Report of machines that have not reported in more than 30 days.

4

That makes sense. I was operating under the assumption that @egarduno only wanted machines that reported recently. Which even then as long as the machine reports once it would be in the group. If the machine went offline permanently after that it would stay in the group until it was removed from the database. Sorry the brain isn’t fully working today.

5

The best way you could do this is to have a report in the WebReports that reads the “Last Report Time” that is greater than 30 days.

1 Like
6

Great info, I just now need to get access to webreports from an admin that doesn’t like to give out information.

Thanks guys

7

You can do this (session relevance) from the REST API, or through the BigFix Session Relevance Tester, or from the presentation debugger in the console in addition to web reports. You can also do session relevance in a Dashboard or a Wizard, and perhaps in the JavaScript embedded in a Fixlet/Task.

Basically you can do this through session relevance, but you cannot do it through regular relevance, because the client can’t report to you it hasn’t reported if it hasn’t reported.

This should be the case: From the client’s perspective (now - last report time) is always 0, or very near to it, unless it has been sleeping for a period, then it will be greater than how long it was asleep for momentarily, but then it will go right back down to near 0 the very next time it reports.