How does BigFix gather the boot time?

Usage and Config Platform
1

We have some discrepancies where the boot time in BigFix is not reflecting what the server is saying when it was last rebooted.

The particular issue is with a SuSE server.
Uptime on the Linux server says it has been up for 132 days.
Uptime in Bigfix is saying 1,786 days. BigFix is saying that the boot time is Wed, 19 Mar 2014. I am assuming the uptime in BF is generated based on the boot time in BF

When I run who -b on the Linux server I get this…
system boot Mar 19 03:19

My guess is that BigFix is getting the boot time the same way as who -b does, but I would like it confirmed as I can’t explain where BF gets the year when who -b does not show it.

Thanks in advance.

2

Hello jeff-rea,

  1. About uptime:
  • On Windows the agent checks how long it’s been since the first process started on the OS instance.
  • On Linux/Nix/Mac the agent reads data from /proc/uptime.
  1. As far as I remember, “who -b” reads data from /var/run/utmp

Regards,
Vitaliy