Efficient session relevance 'bes property' queries

Content Authoring
1

Is there an analog of bes property "Property Name" for properties that do not have unique names - perhaps a way to create directly based on the 3-tuple of (site id, analysis id, property id)? One can always use bes property whose (id of it = (x,y,z)) but this is apparently unfeasibly slow in an environment with lots of properties.

1 Like
2

This is an option:

names of properties whose("BES Client Version" = name of it) of bes analyses whose(active flag of activation of it AND "BES Component Versions" = name of it)

This is another option: https://developer.bigfix.com/relevance/reference/bes-property.html#property-integer-of-bes-fixlet-bes-property

names of properties 1 of bes analyses whose(active flag of activation of it AND "BES Component Versions" = name of it)

This is another option:

names of properties 1 of fixlets 204 of bes sites whose(1 = id of it)

I agree, there should be a bes properties "x,y,z" option, or some similar way to uniquely specify a single property without iterating over every possible option. It also seems like there is a similarly missing option to reference a bes site by it’s ID directly, without having to iterate over all possible sites.

Also, always use plural relevance, unless you can’t, and even then, try to find a way.

This is ~15ms for me:

number of bes analyses whose(active flag of activation of it)

This seems to be sometimes faster, sometimes slower, but also only return custom analyses:

number of custom bes fixlets whose(analysis flag of it AND active flag of activation of it)

CC: @AlanM

3 Likes
3

I haven’t tried this (yet), but is it possible to use something like
bes properties "Property Name" whose (id of it = ( x, y, z ))

3 Likes
4

Oh, that is interesting. Get multiple by name, then filter from there. I’ll have to give that a try.

5

Unfortunately it does not look like it works. The ‘bes properties “X”’ inspector only returns one result despite its plural appearance.

(it, multiplicity of it) whose (item 1 of it > 1) of unique values of names of bes properties ... AllocateCDRoms, 5 AllocateDASD, 13 AllocateFloppies, 5 Allocatedasd, 2 AllowBasic, 12 AllowDigest, 6 ...

(name of it, id of it) of bes properties "AllocateDASD"
Allocatedasd, ( 11356, 32942, 1 )
1 Like
6

A “named” inspector, which is one with a quoted string, will only return a singular yes. We provide a plural of just about everything to satisfy syntax requirements (such as “nows” which make no logical sense)

Only the “whose” check with the name would provide ALL the answers you are looking for

1 Like
7

Can you post the entire session relevance that’s making it “unfeasibly slow”? As @jgstew often points out, how the relevance is written matters, and session relevance optimizations can especially have a big impact.

My environment has a little over 10,000 bes properties and we can query them quite quickly, depending on how the relevance is written. Here’s a query to find Office installations on clients:

(id of computer of it, name of computer of it, values whose (it as string as lowercase contains "office" as lowercase) of it, last report time of computer of it) of results of bes properties "Installed Applications - Windows"

gives me 1,936 results in 501 ms, accessing the BES property by name (only one instance of this property exists)

(id of computer of it, name of computer of it, values whose (it as string as lowercase contains "office" as lowercase) of it, last report time of computer of it) of results of bes properties whose (name of it = "Installed Applications - Windows")

gives the same results in 500 ms. This one uses a ‘whose’ clause to iterate through the BES Properties, and doesn’t seem to make any appreciable difference in processing time.

Searching by Property ID seems the same -

(id of computer of it, name of computer of it, values whose (it as string as lowercase contains "office" as lowercase) of it, last report time of computer of it) of results of bes properties whose (id of it = ( 3093, 34, 1 ))

500 ms.

The ‘bes property’ lookup time seems negligible.
names of bes properties whose (id of it = ( 3093, 34, 1 ))
takes 12 ms on my system. Depending on your time, you could probably construct a query where that lookup does not impacting the overall performance.

Questions -

  1. What’s your query? Maybe it can be optimized…
  2. How long does it take your server to process names of bes properties whose (id of it = ( x, y, z ))
1 Like
8

Hi Jason,

We are using below mentioned session relevance to extract the BES property value. Now we need to exclude the “device contain = ESXI”, so how we can modify the below mentioned query?

Please help…

(IDs of it, Names of it, concatenation "; " of (it as string) of IP Addresses of it, Operating Systems of it, value of results from (bes property whose (name of it = “Boot Time”)) of it | “Not reported”) of BES Computers

9

In this case, it’s relatively easy as we have a native session relevance inspector for device type. Try:

(IDs of it, Names of it, concatenation "; " of (it as string) of IP Addresses of it, Operating Systems of it, value of results from (bes property whose (name of it = "Boot Time")) of it | "Not reported") of BES Computers whose (device type of it contains "ESXi")

1 Like
10

Thanks Aram, It’s working for me… Thanks again for your support.