Hi All,
I am facing an issue with a baseline where few fixlets are showing not relevant in Console as well as Endpoint logs after a restart however the relevance of these fixlets is “true” means these should be applicable in any case (All machines).
So What could be the reason of it because same thing happened on two machines. Attaching below Endpoint logs.
ActionLogMessage: (action:1388946) ending group action (aborted)
Not Relevant - _CNO - Trend Add CensusQueryServerSSLPort v1.3 (fixlet:1388995)
Not Relevant - (fixlet:1388946)
Relevant - Custom Baseline - Actuarial Oracle Apps Test (fixlet:1135462)
Not Relevant - _CNO - Deploy TrendMicro FDE for BitLocker v6.0.2 (fixlet:1388997)
Not Relevant - _CNO - Absolute Agent v7.20 (fixlet:1388999)
Not Relevant - _CNO - Netskope Client V89 (fixlet:1389000)
Not Relevant - _CNO - Remote device status MTR v4 (fixlet:1389001)
Not Relevant - _CNO - Set Post Deployment Stage v1.5 (fixlet:1389003)
Not Relevant - _CNO - Logon Background Info v1.9 (fixlet:1389004)
1388946 is the id of baseline and after rebooting next action of the baseline executed, and rest become not relevant.
ActionLogMessage: (action:1388946) ending group action (aborted)
This message looks like the machine rebooted while the baseline was running. If the machine reboots without using the ‘restart’ ActionScript command, the action will be marked as Failed. If the restart task before this is using an OS command to trigger the restart (like wait shutdown.exe /R or anything like that), it will cause the action to be marked as Failed and the Rermtry/Reapply action settings will take effect after reboot.
The next component actions switch (in the client log) to ‘Not Relevant’ because the Action itself is no longer relevant - the baseline action has run, and Failed, and will not run again.
If you must reboot within a baseline, use the ActionScript commands to reboot.
(you’ll also get that ‘Not Relevant’ log message for any action that completely successfully, by the way)
Thanks for your response @JasonWalker. yes, for restart there is a task in baseline that have command for restart is “Restart 60”. But the components that was on “pending restart” remained in same state after restart also, they are not showing failed in console or in logs.
And if one or two components pending for restart for more than two hours and post reboot of machine remains in pending restart state, Bigfix considers it as failed?
And when you are saying ‘restart’ ActionScript command, what it means, is it “restart 60”.
Yes, that’s what I mean, the actionscript command restart or restart <seconds> are the correct way to handle restarts within a baseline. That informs the client that a reboot is happening, so the client should stop executing actions at that point and should resume after the reboot.
The ‘pending restart status is not cleared after a reboot’ is a very common issue. When the client starts, it checks several different areas to determine whether there are any indications a reboot is still needed. If any are needed, the ‘Pending Restart’ flag is not cleared for any action statuses. Sometimes badly-designed software updates the PendingFileRenameOperations key on every startup, and the presence of values in that key prevents any Pending Restarts from being cleared. We describe the behavior, and client settings to exclude entries from the list we search, at Determining if a restart is needed - Customer Support
As a worst-case, we describe a value that will ignore all PendingFileRenameOperations values when calculating whether a restart is needed, at List of settings and detailed descriptions -
With the setting _BESClient_ActionManager_PendingRestartExclusions=:; all entries in the Microsoft registry key HKLM\System\CurrentControlSet\Control\Session ManagerPendingFileRenameOperations are ignored because every entry is a path containing always a colon.
However, none of this ‘Pending Restart / Pending Restart Not Cleared’ would cause the later fixlets to show the status ‘Not Relevant’ on the Console result. I think we’d need to get more details on the relevance of the Baseline, those individual Components, and the Action Settings you used when sending the action.
