Exclude a Fixlet from being evaluted in all machines

Content Authoring
1

I’m trying to exclude a Fixlet from being evaluated on endpoints because it is causing the service to fail. Any idea how to prevent fixlet evaluation?

2

Where is the Fixlet being hosted? If it’s in a custom site, are you able to modify the Fixlet’s relevance to include a ‘FALSE’ clause? Or could the Fixlet be moved into a site that does not have Clients subscribed to it?

Is this a custom Fixlet? I’ve never heard of Fixlet evaluation causing the Agent to ‘fail’ (though poor custom relevance can certainly cause delays).

3

This is in the SANS Top Vulnerabilities to Windows Systems Site. Its the W05: Windows Configuration Weaknesses - SQL Server Authentication Logging is Not Enabled (Non-Default Instances). I have about 5 servers that stop the service whenever they evaluate this fixlet. Is there a way to tell endpoints to not evaluate a particular fixlet?

4

There is not a way to configure an endpoint not to evaluate a particular Fixlet in a site to which it is subscribed, no. That said, I’m curious how you’ve determined that this particular Fixlet is causing the Agent service to stop? The relevance of the Fixlet appears to be two very simple registry checks:

(exists key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\MSSQLServer” of registry) AND (value “AuditLevel” of key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\MSSQLServer” of registry = 0)

I really wouldn’t expect these checks to cause the Agent service to stop. Are there perhaps strange permissions associated with these particular registry keys on the endpoints in question?

5

When we stopped SQL on the offending endpoint the service does not crash. Soon as you start it up, it fails and the last line in the log is the fixlet.

6

This may not be the fixlet being evaluated however. There is a client setting to show the fixlet that is about to be evaluated in the EMsg log (EvalLog) so if you had that on it is more likely. Most logs show the fixlet that just WAS evaluated

The subsequent fixlet for example (if your client is evaluating fixlets in order) has exists local mssql database in it which might be more likely having an issue.

7

This inspector does have some known issues on Windows 2003 SP2. You can try blacklisting that inspector

8

How would I do that?

9

There’s a relatively new Client setting you can leverage for this purpose:

_BESClient_Inspector_Blacklist

In this case, I believe it’s value should be:

<local mssql database>
10

Is there a link that talks about this setting. I would like to read up on it.

11

There may not be much as its not a recommended thing to do very often. Blacklisting the wrong inspectors can cause the agent to malfunction as it uses inspectors internally as well.

The specification for the setting is:

_BESClient_Inspector_Blacklist
Type: String 
Version: 8.0 
Platform: All 
Default: None 
Requires Client Restart: YES 
Description: Blacklists an inspector list. for example "name of <operating system>"

So following the suggestion @Aram gave would be correct. This setting merely prevents the named inspector from working at all. Essentially it is removed from the language for functional reasons.

12

But am I able to target specific systems instead of all the endpoints?

13

Yes, this is a client setting so you can make it applicable to one or many endpoints

14

is not one of the evaluators of that fixlet

15

Hi.
Just a question: is it possible to exclude the evaluation of a site ?
… and @AlanM: can you please quote me what IBM manual reports the client setting you quote ?

Thanks

16

I can’t find any public document with a quick search. I pulled that from my internal list of all settings.

To exclude evaluation of a site… unsubscribe from the site

17

Thanks Alan … but … I have over 80.000 computers to unsubscribe / subscribe again and this operation may overwhelm my infrastructure; if there’s another way to do that I prefer it :smile:
I need to stop evaluation to do some other tricks in the meanwhile, so that computer could “breath” instead of evaluating tons of relevance (I talk about Patches for Windows site)

18

So you want only some sites to stop processing or all sites? There is the “sleep” functionality to give the agent a “rest”

1 Like
19

It would be much easier to have clients only evaluate a baseline some of the time, but it would be much harder for it to stop evaluating a site without unsubscribing.

You could increase your BES Client’s CPU usage so that it gets through the sites faster.

Do you have long evaluation loops on your clients caused by the Patches for Windows site?

This is related: