Email App Owners to Reboot BigFix Endpoint

Content Authoring
1

I need assistance creating a Fixlet that will email an App owner when an endpoint needs to be manually rebooted after being patched by an open action.

The endpoints in my BigFix environment have a registry key called “Patch_Window”. Here are a couple of examples for the key value: “Prd - Auto - Sat - 0100-0800” or “Prd - Manu - Sat - 0100-0800”. The value of this string displays the resulting patching conditions:
• Environment Status (Prod or Dev): in this example Prd
• Reboot Status (Auto or Manual): Auto or Manu
• Patch Window Day (Day of week): in this example Sat
• Patch Window Time: in this example (0100-0800) which translates to (1 am to 8 am)

A Fixlet was created to check the Reboot Status of the “Patch_Window” registry key, on an endpoint, and reboot only if the key value contains “Auto”.

During the patching event, the action will patch all relevant endpoints with their relevant Fixlets. The endpoints with automatic reboot status will eventually finish on their own but the endpoints with manual reboot status will require manual intervention. Currently my team manually emails the app owners, for the endpoints, after all relevant Fixlets have been patched and have a status of “Pending Restart”. I would like to create a Fixlet that will email the App owners when the endpoints have applied patches and are “Pending Restart”. Can this be done within the same baseline or will another action need to be created?

I was thinking that the following relevance conditions would have to be established first. In the event that 2nd action has to be created, it would have to get the following info:

• Action state (of patching action) is “Open”
• All relevant Fixlets have been applied and have the result of “Pending Restart”
• “CMG Pending Restart” is True (an evaluation to see if the endpoint needs to be restarted)
• “Open 4 Patching” is “True” (an evaluation of current time and patch window)

After all conditions are met, email app owners using “Computer Name” property, “Monitor_1” and “Monitor_2” (a property that displays app owner email addresses from registry key values) information, letting them know that the endpoint needs to be rebooted.

2

For something like that, I’d actually recommend keeping it outside of the baseline and instead using the REST API to retrieve action statuses and email the owners. The main reason being that it can be complex to make sure all clients have network connectivity to your smtp server and a working mail client.

I’d create an Analysis to retrieve the values of the registry keys you specify to track the owner email addresses, and then read those results along with action statuses via the REST API, and send emails from the one system that is running the REST queries.