Getting Multiple Action Groups

I’m trying to pull the parent information of Actions (like from what’s shown on the Actions link in the console)

If I do something like “(names of it) of bes actions” I get all actions including all member actions. How can I just get the “parent” action?

Answering my own question, this does what I want:

(names of it) of bes actions whose (multiple flag of it)

Still having an issue…

I’m querying using the REST API. When I use a local account that I always use for REST activities it doesn’t return every action. If I query using a master operator account, I get all results.

The REST API account has read access to every site and can administer every computer. It has rights to show other operator’s actions, submit queries and custom content.

If I give the account master operator rights, it returns everything. But when I take that right away it goes back to missing some results.

What would cause this?

The “Show other operators’ Actions” right is tied to a computer, under your account’s administration, posting a result from the action.

A Master Operator will see the actions immediately, but your API account will not see the action until at least one computer has reported a status on the action.

That sort of makes sense, but here’s what I’m seeing.

Action #1 - Expired, 0 computers targeted. Does not show for REST account.
Action #2 - Expired, 8 computers targeted, all 8 show “complete”. DOES show for REST.
Action #3 - Expired, 14 computer targeted, 2 “running”, 12 “failed”. DOES show for REST.
Action #4 - Stopped, 18 computers, 7 “Completed”, 1 “Failed”. Does NOT show for REST.
Action #5 - Expired, 35 computers, 34 “not reported”, 1 “Completed”. Does NOT show for REST.
Action #6 - Expired, 16 computers, 12 “Completed”, 4 “Failed”. DOES show for REST.
Action #7 - Stopped, 1 computer “Pending Restart”. Does NOT show for REST.

Does this sound correct?

And these are all group actions? The earlier filter for “multiple flag of it” would also exclude all single actions.

Otherwise I’d expect the actions that have returned results should be visible to the API account, and it’s interesting that all the missing ones are stopped/expired. I hadn’t considered this case, but it may be that one of the computers needed to be subscribed to the REST operator at the time the action result was reported

Yes, they’re all group actions.

When I run the query using a MO account I can see all actions.
When I run it with the REST account there are many missing.

Also, if I try to access one of the missing actions with the REST account it fails:

https://bigfix.server.com:52311/api/query?relevance=(id of it) of bes actions whose (id of it is 12345)

<Evaluation>
<Time>25.995ms</Time>
<Plurality>Plural</Plurality>
</Evaluation>

But I’m able to access other actions issued by the same operator in the same site without issue so I don’t think it’s permissions related. But I could be wrong?

OK I found the issue!

Your comment “your API account will not see the action until at least one computer has reported a status on the action” is correct.

It turns out that the Actions that were not showing up when I queried with the API account did not have any computers that had reported. My previous comment showing some actions that had completed computers but were not reported was incorrect, I was mixing up results from multiple queries. :roll_eyes:

1 Like