Find a file type on a client machine

I am trying to use the below example to find specific file types on client machines, without much luck:

Searching all disk drives for files can be very resource intensive, so this may be a problem for some installations. For that reason, we recommend using an action to be run only periodically (not every cycle) to gather the information, and then a retrieved property can then gather the retrieved information. For example, to find all of the mp3 files on a system, follow the following steps:
Step 1: Create a Task to generate the list of files
In the TEM Console, select the menu option “Tools”, then "Create New Task Message"
In the “Name” field type in a title such as "Task to find .mp3 files"
In the “Message:” field put in a description of the task, such as "This task will search the drive for mp3 files and then write them to the file “mp3files.txt” in the client folder. The action will only run when you apply the task to a computer"
In the “Action” tab, make sure the “Action Script Type” is “BigFix Action Script” and in the “Action Script” field paste the following:

delete __appendfile
delete findmp3files.bat
appendfile @echo off

appendfile del "{pathname of parent folder of regapp "BESClient.exe"}\mp3files.txt"

appendfile echo "{"**" & concatenation "**" of pathnames of descendants whose (name of it as lowercase ends with ".mp3") of folders "\" of drives whose (type of it="DRIVE_FIXED") & "**"}" >> "{pathname of parent folder of regapp "BESClient.exe"}\mp3files.txt"

move __appendfile findmp3files.bat

wait "{pathname of client folder of site "BESSupport"}\RunQuiet.exe" findmp3files.bat 1>NUL 2>NUL

On the “Relevance” tab, remove any text such as “true” and replace with the following:

version of regapp "BESClient.exe" >= "5.1"

You now have a Task that will search the drive for mp3 files and then write them to the file “mp3files.txt” in the client folder. The action will only run when you apply the task to a computer. Any computer that you apply this task to will return the path of the .mp3 file. This task will report back “Failed” on computers that do not have mp3 files on the disk drives. You can safely ignore this report.
Note: Avoid having this task run continuously, since it is very resource intensive, and local users will probably notice the disk access. You can, for example, have this task constrained to run when no user is present to minimize its impact.
Step 2: Create a Retrieved Property
Select the menu “Tools” then "Manage Properties"
Click the “Add New” button.
In the “Name:” field enter something like “MP3 files”. In the “Relevance” field enter the following:

if exists file "mp3files.txt" of parent folder of regapp "BESClient.exe" then if size of file "mp3files.txt" of parent folder of regapp "BESClient.exe" > 10 then (substrings between "**" of (lines of file "mp3files.txt" of parent folder of regapp "BESClient.exe")) else "N/A" else "No MP3 files"

This is what the BESClient log says:

At 15:20:21 -0400 - 
   GatherHashMV command received.
At 15:20:21 -0400 - mailboxsite (http://TEMROOT.lortobco.com:52311/cgi-bin/bfgather.exe/mailboxsite10823673)
   Downloaded 'http://TEMROOT.lortobco.com:52311/mailbox/files/19/16/191652875402e7cbb86b009af4c6a2d22700224c' as 'Action 25082.fxf'
   Gather::SyncSiteByFile adding files - count: 1
At 15:20:21 -0400 - 
   Successful Synchronization with site 'mailboxsite' (version 130) - 'http://TEMROOT.lortobco.com:52311/cgi-bin/bfgather.exe/mailboxsite10823673'
   Processing action site.
At 15:20:23 -0400 - mailboxsite (http://TEMROOT.lortobco.com:52311/cgi-bin/bfgather.exe/mailboxsite10823673)
   Relevant - Task to fine .mp3 files - test (fixlet:25082)
At 15:20:23 -0400 - 
   ActionLogMessage: (action:25082) Action signature verified for Execution
   ActionLogMessage: (action:25082) starting action
At 15:20:23 -0400 - actionsite (http://TEMROOT.lortobco.com:52311/cgi-bin/bfgather.exe/actionsite)
   Command succeeded delete __appendfile (action:25082)
   Command succeeded delete No 'C:\Program Files\BigFix Enterprise\BES Client\__BESData\actionsite\findmp3files.bat' exists to delete, no failure reported (action:25082)
   Command succeeded appendfile @echo off (action:25082)
   Command succeeded (file created) appendfile @echo off (action:25082)
   Command succeeded appendfile @echo off (action:25082)
   Command succeeded appendfile del "C:\Program Files\BigFix Enterprise\BES Client\mp3files.txt" (action:25082)
At 15:22:22 -0400 - actionsite (http://TEMROOT.lortobco.com:52311/cgi-bin/bfgather.exe/actionsite)
   Command failed (Relevance substitution failed) appendfile echo "{"**" & concatenation "**" of pathnames of descendants whose (name of it as lowercase ends with ".mp3") of folders "\" of drives whose (type of it="DRIVE_FIXED") & "**"}" >> "{pathname of parent folder of regapp "BESClient.exe"}\mp3files.txt" (action:25082)
At 15:22:22 -0400 - 
   ActionLogMessage: (action:25082) ending action
At 15:22:22 -0400 - mailboxsite (http://TEMROOT.lortobco.com:52311/cgi-bin/bfgather.exe/mailboxsite10823673)
   Not Relevant - Task to fine .mp3 files - test (fixlet:25082)
At 15:22:23 -0400 - 
   Encrypted Report posted successfully
   ForceRefresh command received.  Version difference, gathering action site.
   Successful Synchronization with site 'actionsite' (version 9516) - 'http://TEMROOT.lortobco.com:52311/cgi-bin/bfgather.exe/actionsite'
   Gathering all operator/mailbox sites.
   Successful Synchronization with site 'mailboxsite' (version 130) - 'http://TEMROOT.lortobco.com:52311/cgi-bin/bfgather.exe/mailboxsite10823673'
   Successful Synchronization with site 'opsite103' (version 6855) - 'http://TEMROOT.lortobco.com:52311/cgi-bin/bfgather.exe/opsite103'
   Successful Synchronization with site 'opsite116' (version 6928) - 'http://TEMROOT.lortobco.com:52311/cgi-bin/bfgather.exe/opsite116'
   Successful Synchronization with site 'opsite122' (version 9443) - 'http://TEMROOT.lortobco.com:52311/cgi-bin/bfgather.exe/opsite122'
   Successful Synchronization with site 'opsite2' (version 6855) - 'http://TEMROOT.lortobco.com:52311/cgi-bin/bfgather.exe/opsite2'
At 15:22:24 -0400 - 
   Encrypted Report posted successfully
At 15:22:58 -0400 - 
   Encrypted Full Report posted successfully

It looks like from this that you are trying to use the concatenate inspector but not correctly? See https://developer.bigfix.com/relevance/reference/string.html#concatenation-string-of-string-string

Also be aware that “descendants” is a very very intense inspector that can take hours to run depending on your system so I’d probably not suggest you do it with relevance rather make some PowerShell or VBS or shell script to do this which will run at full speed in the action.

Thanks AlanM. I’m not really concerned about the time or resources it takes or consumes at this point. I’m not quite sure how to fix the concatenation issue with the link you gave me. Basically, I’m seeking a way to find a file type on a small hand selected group of clients, and have that report back to Tivoli the location of the files and what machines have the files. This won’t run real time, but only when asked to be ran. Any further ideas are greatly appreciated.

Regards,

Matt

You can try a powershell script to loop over the found physical drives and then search for *.mp3 files and append them to a file.  I've tested this in the fixletdebugger and it seems to work.


    delete __createfile
    delete c:\windows\temp\mp3_search.ps1
    delete c:\windows\temp\mp3files.txt
    
    createfile until EOF
    $drives = Get-WmiObject win32_volume | ? {{$_.DriveType -eq 3} | % {{Get-PSDrive $_.DriveLetter[0]}
    foreach ($drive in $drives){{
        $path = $drive.root + "*.mp3"
        cmd.exe /C dir /s /b /a /o:gn $path | out-file -append -filepath c:\windows\temp\mp3files.txt -encoding ASCII
    }
    
    EOF
    
    copy __createfile c:\windows\temp\mp3_search.ps1

    runhidden cmd /K powershell.exe -ExecutionPolicy Bypass c:\windows\temp\mp3_search.ps1

For the analysis you can try something like:

IF (exists file "c:\windows\temp\mp3files.txt") THEN substrings separated by "%0d%0a" of (lines of file "c:\windows\temp\mp3files.txt") ELSE "Does Not Exist"

Dakota:

This is absolutely perfect! Thank you so very much for taking the time to research, test and share this gem!

Warmest Regards,

Matt