Custom Site - Computer Subscriptions

[rickbrand]

We use the “Computers which match” option along with a relevance statement on the “Computer Subscriptions” tab of a custom site to subscribe computers to the site. That works great.

If I issue a “custom site unsubsribe” command, the computer will be unsubscribed from the custom site (as expected).

Will the “Computers which match” relevance ever be re-applied to the computer and re-subscribe the computer to the site? In its current condition, there appears to be a mismatch/conflict between the site’s relevance statement and the computer’s actual subscriptions. The relevance statement evaluates to TRUE, but the computer is no longer subscribed to the site. I can see this causing issues if/when we need to troubleshoot site subscriptions.

[rickbrand]

I was eventually able to determine why the site relevance was no longer being applied. When an endpoint is subscribed to a site, BigFix writes an “effective date” value to a sub-key of the [Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BigFix\EnterpriseClient\Settings\CustomSites key]. The date is assumed to be the last modified date of the site relevance. If a manual subscribe or unsubscribe action is taken on the endpoint, the “effective date” is updated to reflect the date of the change. If the change date is greater than the date assigned by the site relevance, the site relevance is ignored and no longer applied.

[JasonWalker]

Ah, yes, that’ll do it…manual subscribe/unsubscribe actions do override reapplying the policy, much like editing a client setting manually would override a policy action to set the values, based on the “effective time” handling.

[rickbrand]

Jason, do you know where the “effective date” set by the site relevance is stored? I assume, but cannot verify, that the date may be the last modified date of the relevance. For example, if a site’s relevance causes a site subscription to happen, I will see a date from the past in the “effective date” (e.g. Oct 2021).

A related question… in the BES Client log, a fixlet is mentioned when the site subscription takes place. This fixlet appears to be a system or hidden fixlet as it does not appear in Fixlets and Tasks.

Super geeky stuff… I know.

[D.Dean]

It is stored in the registry.

I believe if you make a modification to the site relevance, then change it back, it would update the date and resolve your issue.

[JasonWalker]

Yeah, it’s a system Action (in the client logs an Action is a subclass of a Fixlet).
I think there’s a BESAdmin option to allow showing system actions, but it’s somewhat risky - for example, stopping, deleting, or duplicating a site subscription action or an operator rights assignment action could have some unpredictable results. Computer Group memberships for automatic groups are another type of hidden action too.