Deleted Computers showing up on BFI Computers Report

[gregoryjj]

One of our engineers does an API call to BFI DB to export all computers in the database in a .zip format and it’s returning ~50000 rows (computer objects). However, we only have ~9800 computers in BigFix console. There is a huge discrepancy between the two. We did find out that the report contained deleted objects from years ago, which should be gone from the DB. I always thought deleting the computer from BigFix console deletes the object from the DB. Is that correct? If not, then what is the process of cleaning up the historical computers within BigFix DB.

I’ve already tried the steps outlined in the article below and waited after the data import but issue remains.

https://help.hcltechsw.com/bigfix/9.5/inventory/Inventory/admin/t_automatic_decommissioning.html

Any help would be appreciated.

[ssakunala]

Which API are you using to retrieve the computers information? Are any filters used for the API? Since BFI is historical database and the software and hardware information is tied together, some information is not deleted but marked with end dates

[trn]

What is the last report time for these computers?

And are they subscribed to sites your operator account can see?

[gregoryjj]

We have ~9800 active computers that are reporting to BigFix console but there are ~50000 computers that are in the BFI database and majority of them are deleted computers from BigFix console. So, they are not reporting to any sites in BigFix.

So, my question is how do I remove computers from BFI that have already been deleted from BigFix? For example, we have computers that show up in the report that were deleted 3 years ago.

[gregoryjj]

I’m waiting on my engineer to provide me that info.

[ssakunala]

What information do you see in Reports -> Computers? There is “Last Seen” column in this report which will show the age of computers and this will be current as of the last import time for the computers that are visible in the BigFix Console.

Assuming you are using api/sam/computer_systems, criteria can be used on last_seen to filter for records. Here is an example to show computers that are last seen within the last 7 days.

<
https://BFIServer:PORT/api/sam/computer_systems?criteria={“and”:[[“last_seen”,“last”,“P7D”]]}
/>

There are other examples in the online documentation:
https://help.hcltechsw.com/bigfix/10.0/inventory/Inventory/integration/r_get_computer_systems.html

[gregoryjj]

I do see the “Last Seen” column. I’m not sure if the engineer is using any filters but I guess he would have to use one for the “Last seen” attribute to get data that is based on the active computers in Bigfix. I have also reached out to HCL and they told me to run the BES Computer Remover tool to completely purge computer objects that have been marked as deleted. I will test this and update the thread.

[SLB]

I don’t use BFI myself but if it uses the same underlying Bigfix platform and processes, its possible you would need to use the Admin Tool to delete any aged records. Prior to 9.5 there were standalone tools for deleting old content, from 9.5 and onwards its part of the Bigfix Administration Tool, under the Clean Up tab, where you can also setup a schedule so this is done automatically after a certain number of days.

[JasonWalker]

I’d also note that Inventory keeps historical data to report your computer and software license usage over time. As we could report on you license usage for a period in the past, it is necessary to keep computers after they have been decommissioned (and license info for applications that have since been removed).

What API call are you using, and what do you want it to reflect? All computers that have existed, or a specific point in time,.or only the current state?

I would expect to use the valid_from and valid_to fields in that case

[JasonWalker]

Actually the ‘is_deleted’ filter may be more along the lines of what you need – see https://help.hcltechsw.com/bigfix/10.0/inventory/Inventory/integration/r_get_computers_v2.html

[gregoryjj]

Jason - I don’t have the filter or API call information as I’m not the person running the script (waiting for that info from engineer) but the report is showing all historical data. We don’t have any need to keep historical data for any endpoints that are no longer in our environment. HCL suggested to use the BES computer removal tool to purge out historical data based on our retention time period.

[JasonWalker]

Sure, the BES Computer Remover will pull it out of the console, but does not remove deleted computers from Inventory.

[gregoryjj]

So, how can I delete historical computer objects from inventory that are past 180 days.

[Sagar_v_d]

You can use this settings to remove inactive computers from BFI.

[gregoryjj]

Tried that already and doesn’t work.

[ssakunala]

Hi Gregory,
As Jason pointed out, BFI is historical and the information is stored in the database with deleted hw and sw information marked with end dates/deleted set.

Filters will need to be used with the APIs, depending on the API used.

[gregoryjj]

what is the filter api syntax to use the “Is_deleted” attribute? Any specific place where this should go into the script?

[ssakunala]

is_deleted is available in api/sam/v2/computers API. Here is an example:
https://Server:PORT/api/sam/v2/computers?criteria={%22and%22:[[%22is_deleted%22,%22=%22,%220%22]]}

https://help.hcltechsw.com/bigfix/10.0/inventory/Inventory/integration/r_get_computers_v2.html

[gregoryjj]

So we want to filter out for computers that have not been deleted. would the example you provide accomplish that result? Basically, we need to filter out computers that are active and not deleted. So a is_deleted value of false is what i’m looking for as far as the api syntax.

[ssakunala]

is_deleted=0 => Computer Not Deleted
is_deleted=1 => Computer Deleted

https://Server:Port/api/sam/v2/computers?criteria={“and”:[[“is_deleted”,"=",“0”]]}

Running the API with out filter gives all data to check the value for this field