Can't see how many times a repeating action has applied in WebUI

Usage and Config WebUI
1

I can’t seem to find how many times a repeating action / deployment has been run on a particular computer. Is this info available anywhere within the WebUI?

I think this is very critical information that could be a sign of a serious problem if it has repeated hundreds of times, particularly when you don’t expect it to.

In the case of policy actions, I think how many times it has applied in total, and per endpoint average, and per endpoint are some of the most important pieces of information.

CC: @lizlinhthi @AaronBauer

2

That information doesn’t look like it’s available in the UI portions of the WebUI, and we don’t call out policy actions very specifically in the UI either.

That said, the ETL APIs which we use to build the WebUI definitely do have information about what you’re looking for though so this is possible to add on. Fields like try count and retry count exist, and we could calculate endpoint average based off of that.

1 Like
3

Yes, this is also true, and would be useful to more easily tell.

Thanks, and glad to know this is possible.

4

James - Thanks for bringing this up. I’m adding it to our request list.

5

Has there been any further development on this? It would certainly be very valuable to see how many times a repeating action ran on a particular endpoint.

6

Yes, was this ever added? We have some clients where a baseline will run hundreds of times, but not all the time, and not all systems. Not even the same systems. Frustrating. I am having to set it to policy then stop the reapply unlimited, setting it to only one retry. Kinda defeats the purpose of making it a policy. I would love a report that automatically emailed me if a client was running any baseline more than twice.

Note that using the console, I can see how many times a baseline was applied in the client status page. Cannot find anywhere else I can see this information.

7

Here’s a way to see the count in a custom report in WebReports. I ran this session relevance query against my BFI policy action which runs the capacity scan and uploads the resuls.

Q: (names of computers of it, ids of actions of it, names of actions of it, apply counts of it) of (results of bes actions whose (state of it is "Open" and source fixlet of it is (bes fixlet whose (name of it is "Run Capacity Scan and Upload Results (11.0.3.0)"))))
A: BFC, 1443, [BFI Policy] Run Capacity Scan and Upload Results (11.0.3.0), 3090
A: bfcltcntos.learn.ais.org, 1443, [BFI Policy] Run Capacity Scan and Upload Results (11.0.3.0), 99
A: BFSERVER, 1443, [BFI Policy] Run Capacity Scan and Upload Results (11.0.3.0), 2971
A: BFI, 1443, [BFI Policy] Run Capacity Scan and Upload Results (11.0.3.0), 3129
A: BFCLTWIN, 1443, [BFI Policy] Run Capacity Scan and Upload Results (11.0.3.0), 93

In my lab environment this doesn’t take very long to execute, however I’m sure it needs some fine tuning to be efficient in a production environment, and will need some tweaking to be useful in monitioring for circumstances that are interesting to you, @Mike_Mills. You may want to configure this so it only returns a result if the apply count is greater than 2, and then create a scheduled activity that will generate an alert when the number of rows in the report changes (presumably from none to one or more).

The key is the apply counts of results of bes actions. When the action we are looking for is expired, this qurey is slow, even in my lab environment. When the action is still open, it is much faster.

1 Like