Client Debug Log

Usage and Config Platform
1

(imported topic written by Steve91)

Chaps

In an effort to pin down our current performance problems (assets not reporting for 2 or 3 hours) I’ve started looking at the client debug logs

What specifically do I need to be investigating in these logs?

There’s quite a few entries similar to the following:

Fri, 23 May 2008 15:59:54 +0100: Evaluate file (Multiple Action Group 00-114797.fxf)

Fri, 23 May 2008 15:59:57 +0100: DebugMessage Relevance evaluation time > 1 second (id - ms) (Parent -2329)

Fri, 23 May 2008 16:00:49 +0100: Complete file (Multiple Action Group 00-114797.fxf: 54742)

Mon, 26 May 2008 19:25:41 +0100: Evaluate file (Multiple Action Group 00-119312.fxf)

Mon, 26 May 2008 19:27:58 +0100: DebugMessage Relevance evaluation time > 1 second (id - ms) (119347 - 1110)

Mon, 26 May 2008 19:28:01 +0100: DebugMessage Relevance evaluation time > 1 second (id - ms) (119348 - 1112)

Mon, 26 May 2008 19:28:12 +0100: DebugMessage Relevance evaluation time > 1 second (id - ms) (119350 - 1596)

Mon, 26 May 2008 19:28:21 +0100: DebugMessage Relevance evaluation time > 1 second (id - ms) (119351 - 1593)

Mon, 26 May 2008 19:29:14 +0100: DebugMessage Relevance evaluation time > 1 second (id - ms) (119361 - 1093)

Mon, 26 May 2008 19:31:05 +0100: DebugMessage Relevance evaluation time > 1 second (id - ms) (119389 - 1624)

Mon, 26 May 2008 19:31:16 +0100: DebugMessage Relevance evaluation time > 1 second (id - ms) (119391 - 1098)

Mon, 26 May 2008 19:31:24 +0100: DebugMessage Relevance evaluation time > 1 second (id - ms) (119392 - 1126)

Mon, 26 May 2008 19:32:27 +0100: Complete file (Multiple Action Group 00-119312.fxf: 406064)

Looking at this second one, it’s a baseline of 83 Microsoft Patches.

Am I right in thinking this is taking 7 minutes to evaluate? Seems quite a long time.

Also, the baseline is targeted by relevance at servers only, so it seems strange to me that desktops are evaluating it, should they not just evaluate the baseline relevance, decide it’s not relevant and so ignore evaluating the components?

Given this, should I be looking at all the fixlets/tasks/actions that are taking more than 1 second to evaluate, with a view to improving them by better relevance or removing if no longer required?

Cheers

Steve

2

(imported comment written by BenKus)

Hi Steve,

Yes. You have come quite far in your analysis and you are on the right track. Having lots of open actions (especially large multi-action groups and baseline actions) can significantly slow the agent down from some normal activities (like reporting). In particular, large multi-action groups that are “constrained” by time (“run-between”, “run only when …”).

We made some significant changes in BigFix 7.0 (with efficient mime enabled) to make the agent much more efficient at handling large actions… but you can only enable efficient mime once all your agents are upgraded to 7.0 (otherwise the 6.0 agents will stop responding to you)…

The best thing to do now:

  • Run the health check dashboard and look for recommendations.
  • Stop any unnecessarily open actions (especially large multiple action groups).

I can see from the action numbers that you have an awful lot of actions (almost 120,000 actions is quite a lot :))

Ben

3

(imported comment written by Steve91)

Thanks Ben

Regarding the action count, is this not just a constantly rising number, i.e. a count on how many actions have been deployed since BES has been installed?

We currently have 37 open actions - 21 of these are policies.

Cheers

Steve