One of our engineers does an API call to BFI DB to export all computers in the database in a .zip format and it’s returning ~50000 rows (computer objects). However, we only have ~9800 computers in BigFix console. There is a huge discrepancy between the two. We did find out that the report contained deleted objects from years ago, which should be gone from the DB. I always thought deleting the computer from BigFix console deletes the object from the DB. Is that correct? If not, then what is the process of cleaning up the historical computers within BigFix DB.
I’ve already tried the steps outlined in the article below and waited after the data import but issue remains.
Which API are you using to retrieve the computers information? Are any filters used for the API? Since BFI is historical database and the software and hardware information is tied together, some information is not deleted but marked with end dates
We have ~9800 active computers that are reporting to BigFix console but there are ~50000 computers that are in the BFI database and majority of them are deleted computers from BigFix console. So, they are not reporting to any sites in BigFix.
So, my question is how do I remove computers from BFI that have already been deleted from BigFix? For example, we have computers that show up in the report that were deleted 3 years ago.
What information do you see in Reports -> Computers? There is “Last Seen” column in this report which will show the age of computers and this will be current as of the last import time for the computers that are visible in the BigFix Console.
Assuming you are using api/sam/computer_systems, criteria can be used on last_seen to filter for records. Here is an example to show computers that are last seen within the last 7 days.
I do see the “Last Seen” column. I’m not sure if the engineer is using any filters but I guess he would have to use one for the “Last seen” attribute to get data that is based on the active computers in Bigfix. I have also reached out to HCL and they told me to run the BES Computer Remover tool to completely purge computer objects that have been marked as deleted. I will test this and update the thread.
I don’t use BFI myself but if it uses the same underlying Bigfix platform and processes, its possible you would need to use the Admin Tool to delete any aged records. Prior to 9.5 there were standalone tools for deleting old content, from 9.5 and onwards its part of the Bigfix Administration Tool, under the Clean Up tab, where you can also setup a schedule so this is done automatically after a certain number of days.
I’d also note that Inventory keeps historical data to report your computer and software license usage over time. As we could report on you license usage for a period in the past, it is necessary to keep computers after they have been decommissioned (and license info for applications that have since been removed).
What API call are you using, and what do you want it to reflect? All computers that have existed, or a specific point in time,.or only the current state?
I would expect to use the valid_from and valid_to fields in that case
Jason - I don’t have the filter or API call information as I’m not the person running the script (waiting for that info from engineer) but the report is showing all historical data. We don’t have any need to keep historical data for any endpoints that are no longer in our environment. HCL suggested to use the BES computer removal tool to purge out historical data based on our retention time period.
Hi Gregory,
As Jason pointed out, BFI is historical and the information is stored in the database with deleted hw and sw information marked with end dates/deleted set.
Filters will need to be used with the APIs, depending on the API used.
is_deleted is available in api/sam/v2/computers API. Here is an example: https://Server:PORT/api/sam/v2/computers?criteria={%22and%22:[[%22is_deleted%22,%22=%22,%220%22]]}
So we want to filter out for computers that have not been deleted. would the example you provide accomplish that result? Basically, we need to filter out computers that are active and not deleted. So a is_deleted value of false is what i’m looking for as far as the api syntax.
