The BigFix team is pleased to announce the release of version 9.5 Patch 9 (9.5.9.62) of the BigFix Platform.
The main features included in this release are:
Added signature to the Red Hat installation packages
Starting from BigFix Version 9.5.9, the Red Hat RPM packages for Server, Agent and Relay are signed with a PGP key. Also the CentOS BigFix Agent and Relay use the same Red Hat binaries. The same applies to Oracle Linux BigFix Agent
Ability for endpoints to constrain the download action if the client is not connected to the designated (preferred) relay
BigFix 9.5.9 introduces the capability to prevent starting actions requiring downloads when the BigFix Agent is not connected to a preferred Relay. In such scenario, the user can avoid that actions are executed if the total size of the downloads associated to the action exceeds a configurable value
Ability for Web Reports to restrict access to some properties
BigFix Version 9.5.9 introduces a new client setting that allows to configure a list of properties that will be blacklisted for Web Reports. This will help to prevent reporting on large or privacy sensitive data as well as to limit memory usage
Improved Relay scalability by supporting 5000 endpoints per Relay
BigFix leaf relays for the Windows and Linux platforms can be configured now to manage up to 5000 endpoints. This 500% scalability improvement means reduced cost to deploy and manage IT assets, while maintaining the superior visibility and security that BigFix is known for
Other Enhancements
ā Added support for IBM BigFix Agent and Relay on AIX 7.2 on Power 9
ā APAR and defect fixes
ā Security enhancements
A Pre-Upgrade check Fixlet is available. The Fixlet performs a set of checks to verify if the IBM BigFix Server can be successfully upgraded to 9.5.9. A log file is created in the IBM BigFix Server directory containing details about the executed steps.
Iām curious to see how this is implemented. Does installing the relay automatically adjust the OS configurations (TCP tuning on Windows, nofiles limits on linux)? Or is there content available in BigFix that does this post-install?
Right. Was there an update in the BES Relay v9.5.9 application that now scales for 5000 endpoints or was it just a confirmation that any BES Relay version running with hardware of 4 core/8GB RAM is cable of supporting 5000 clients?
Really need to read the Optimization & Performance Guide on this one. I think itās more that the Relay can support 5000 endpoints given the cores/RAM, AND youāve applied the OS tuning for the relay (shortening the TCP TIME_WAIT delay, increasing the range of Ephemeral ports, etc.)
FWIW, Iāve already relays running up to 2000 clients per each, having applied most of the OS tuning several years ago. Itās not a recommended configuration, but itās always been āpossibleā though your mileage may vary of course.
I think thereās also stuff in the guide about tuning reporting frequency on the clients, batch counts on the relays, etc.
What does this mean for relay-to-relay numbers? For our 3k relays, we have top level relays hosting between 92-144 site relays. I would love to remove some of my 27 top level data center relays.
If Iām reading it right, the diagram shows an implementation of 125,000 end points using 25 leaf nodes reporting to 5 top level relays, which are reporting to a false root.
I think the Capacity Planning guide was updated for the new Relay to endpoint ratios, and it shows each top level relay managing a maximum of 40,000 total endpoints or 120 relays, whichever comes first. The diagram in the blog post represents an architecture where each top level relay is managing 25,000 endpoints through 5 relays.
A big part of our relay scalability improvement has been driving sufficient workloads and failure modes that we can have confidence this will āstand upā in the field and deploy at scale. There are definitely content and health improvements we would like to make to further reduce management cost, but wanted this improvement out asap as the benefits are significant. There is more we want to do.
In terms of OS configuration, it is very workload dependent and much more typical on Linux. We also want to do a deeper dive on Tiny Core Linux in this scenario, and expect to publish on our results/recommendations.
I like the TCL relays, I have a handful in my environment and in my DMZ. Though the process in creating a template via the download from TCL, from BigFix, and the instructions, it would be nicer to just have a single virtual appliance that one could download from BigFix already to go. Just import into your VI and answer a few questions at startup.
Nope. If you see the instructions, you need to download the relay ISO from IBM, then the TCL ISO from where ever, then build a template. As I said, itās not difficult and the directions are good, but I rather just download a single virtual appliance from IBM all ready to goā¦
Iām having a hard time finding documentation on what has actually changed. The release notes indicate that something on the relays improved ā did something actually change in the relay software or is IBM just now willing to support customers creating larger relays (2-4 core, 4-8gb RAM)?
