Hi all …
My client has 5 entries in his BigFix console where no computer name or IP address is being reported.
Of the five entries, three are greyed out so we’ll just delete those. However, two of them appear to be alive.
How can I debug this and figure out what agent is connecting to BigFix and reporting … nothing?
–Mark
You can use the BigFix Client Refresher to tell the clients to report all of their properties.
What happens if you “right click” the active systems and choose “Send Refresh”? That should cause the systems to resend all of their properties.
I’ve seen this kind of behavior when computers have been removed from the database, their data is purged and they later get powered up again and send the normal incremental client report. It’s uncommon in my environment, but it does happen. We auto delete non-reporting systems after 90 days, and their data is purged after 180 days.
What you need to remember is that for efficiency reasons, the clients only report property values when they have changed. This way there is reduced network traffic and the server only has to ingest updated properties.
Without knowing more about your BigFix setup and your Network in general, we can’t really help with the issue. If you have large numbers of systems that don’t report the basics like Computer Name and IP Address, you might consider opening a PMR.
Add the “computer id” and “agent type” properties to you column view and see what that returns.
Good suggestions. Will let you know what happens.
@mtrain Use this: https://bigfix.me/fixlet/details/6033
Be careful how you deploy it. Not a good idea to deploy as a policy on all systems.
I believe this only works if the endpoint gets UDP notifications.
Clients only send differential reports unless a “refresh” command is given which causes the client to re-report ALL properties. This means that if the first report that contained these values was lost, the client will never send the values again until the values change, which there are many reasons why they wouldn’t change.
You must be VERY careful when causing clients to send FULL reports. If you do this to ALL systems at the same time, it will likely overload your relays and root server with reports that will take much longer than normal for the root server to process into the DB.
The only way I know of to guarantee that clients send a Full report using normal means within the console is to target them with an action containing notify client ForceRefresh which they will eventually gather (24hours or so max) and execute.
Apparently the BigFix Client Refresher does not actually guarantee that unless they are deleted: “The 2nd and 3rd methods do not guarantee that the clients will actually perform a refresh, but it does send out a UDP to immediately force clients to send a full report.”
An action with notify client ForceRefresh is the only guarantee. (BigFix Client version 6.0.14 and above)
What I’m hoping to see is that the “Agent Type” returns that it’s some kind of proxy agent - VMWare, Bare Metal Proxy, or something along those lines where “hostname” and “IP Address” might not be valid properties. Otherwise, having the Computer ID will let us retrieve other properties for the client that may point to more answers.
If you are meaning this inspector - https://developer.bigfix.com/relevance/reference/bes-computer.html#agent-type-of-bes-computer-string - then it will return either “Native” or “Proxy - <name of extender>” from what I can see.
@jgstew, oh yes, I am very familiar with Send Refresh and know not to do this on many computers. For now, nothing is being deployed - I simply asked my client to run the “Send Refresh” command on the two active computers with no-names and we’ll see what happens. For the moment, I will assume UDP is open.
–Mark
Hi all … sending the “Send Refresh” to the two computers resolved this issue.
–Mark
