Bigfix Inventory Application Usage Question

[RupG]

I have inventory scanner configured to ran all different types of scans (catalog, file, package etc) and also enabled “Application Usage Scan”.
Scan action is configured to runs one a week on all endpoints including Windows.

My question is if the scan action runs at 7 AM for example, does it only report on application usage data of the applications which are running at that time or is there a way that scanner can read past data about the details of various processes and when those were launched (date and time) and how long they stayed running in the memory etc from the OS somewhere?

In other words, as an example, If I used excel.exe every day for the last 6 days for few minutes to couple hours and when the “Initiate scan” action runs on 7th day and completes its scan in few minutes, will it be able to tell that excel process was used in the past 6 days or is it going to say excel was not used as its not running at the time the scan is being performed.

If yes, How does it know the history of the process executions as scanner does not run all the time and I do not see any background process in the memory always running and calculation application usage data!!

[itsmpro92]

The BigFix Client is monitoring application usage every 5 seconds through an inspector called application usage summary. This is activated via three Client Settings:

• _BESClient_UsageManager_EnableAppUsageSummary
• _BESClient_UsageManager_EnableAppUsageSummaryPath
• _BESClient_UsageManager_EnableAppUsageSummaryApps

Updated with better detail
AppUsage raw data is stored in the <BESClient Home>\__BESData\__Global\UsageData

In BigFix Inventory, the Scanner will read data from the stat files in this folder, and aggregate the information into various app_usage files in <BESClient Home>\ LMT\CIT\,

In BigFix Inventory, Analysis 10: Application Usage Statistics is activated so that the accumulated data gets captured as computer properties in the BigFix database, where the BFI Import Process can access it.

There is an old IBM Support document that describes troubleshooting Software Usage in BFI’s predecessor product that will help you understand the flow of data: Software Usage shows < no data >

[RupG]

itsmpro, thanks for the information. That brings up couple more questions.

1. I see that I have all three besclient settings on all end-points and also the analysis “Application Usage Statistics” is activated. So Bigfix client is looking at the running processes and storing that software usage data every 5 minutes. Where is it storing it. Is it sending that data to root server in regular agent reports?

2. “Analysis 10: Application Usage Statistics” has two properties and both just read existing files “\ LMT\CIT\app_usage_data” & “\ LMT\CIT\app_usage_data_with_paths_data”. Are these two files created by Bigfix agent from that 5 minutes data check or are these created by Inventory scanner when it runs every 7 days?

3. If the above two files are created by inventory scanner every 7 days, how would these have old information (e.g. execution of excel.exe for the past 6 days )?

4. Does the “upload scan results” task uploads information in these two files to “bes enterprise DB” and then this information gets imported into BFI DB via the daily imports and that makes up the application usage reports or is there some other SW usage data (directly collected from bes client) from bes enterprise DB to BFI DB in the daily reports?

Thanks.

[itsmpro92]

Hi @RupG,

(See the updated response above)

1. It is in UsageData folder under __BESData\__Global
2. These files are created when the scanner runs on the endpoint
3. The scanner collects the raw data from the UsageData folder
4. The BFI Import process (running every 24hrs by default) collects and aggregates the App Usage data from the Computer Properties defined in the Analysis from the BigFix Database

Hopefully, it is more clear now how the data flows from the Client to BigFix to BFI for reporting.

[RupG]

Thanks Boyd, your reply cleared up lots of questions.

Appreciate all the information you provided.