False positive - UDP?

Hi all.
i have an inusual case. The followin patch “MS18-JUL: Security Monthly Quality Rollup - Monthly Rollup - Windows 7 SP1 - KB4338818” have several relevants endpoints.
When send the fixlet to one relevant endpoint the result is “Not relevant” :confused: but it’s still relevant in the fixlet.
If i send “Force Refresh” to the endpoint ceases to be relevant for this fixlet and many more.

Is this a UDP problem?

thanks in advance.

I think you should use the fixlet debbuger on the target machine to check locally the relevance of the fixlet or Fixlets you want to troubleshoot, for a start.

Also read this document: http://www-01.ibm.com/support/docview.wss?uid=swg21505562

1 Like

If a “Send Refresh” causes the fixlet to update to non-relevant, I’d think it more likely that your client is having a slow evaluation cycle (and the fixlet applicability would eventually update on its own), or your client is having some kind of problem posting reports.

3 Likes

i think it would be something like that.
I´m going to reserch with the evaluation cycle.
I will inform in this post.
thanks.

The client will only report deltas unless you send a force refresh. So either the content was evaluated again and the value changed or maybe a report was lost which the force refresh cleared up.

If anyone manipulates, deletes etc the files in __BESData this can cause problems like this. More recent clients will automatically do the equivalent of a force refresh if the master actionsite was missing when they start up for example.

3 Likes

I have a open PMR case.
I´ll keep you informed.