How to serch the fixlets and machines that a action result is "Failed"

When I run a action using baseline (including some fixlet about MS patch ) , I found some “failed” on fixlets and machines.

I know that I can see all the computers status for one fixlet if I click the fixlet one by one.
But this is too hard. Because this baseline has 100 fixlets.

So I want to search the fixlets and machines that Action result is “Failed” easily.
If you have any idea, please teach me.

On the BigFix Console, open Actions under All Content and select your action from baseline, then open the Computers tab. You can see failed machines.
Now click one of failed machine to open View Action Info dialog. The Sub-action Status section indicates which Fixlet has failed.

I’ve already understood about your answer. But the way is too heavy because I manage over 30,000 machines and about 100 fixlets in a baseline.
So I want to know a easy way.
ex) list up failed system and fixlet,error code.

In that case, perhaps session relevance can help, but you need to write relevance expression.
Information on session relevance is available at: https://developer.bigfix.com/relevance/guide/session/

I am not an expert of session relevance, but something like following could help you find failed computer and actions:
((id of it, name of it) of computer of it, (id of it, name of it, time issued of it, (if exists source fixlet of it then (if baseline flag of source fixlet of it then "baseline" else "fixlet") else "action" )) of action of it) of results whose (status of it is bes action status failed) of bes actions whose (time issued of it > (now-30*day))
This is supposed to list all of failed actions and computers which issued within 30 days.

You can run session relevance either in Web Report or on the Console.
To use Web Report, open Web Report, Explore Data > Custom and enter following in the source and click preview

<div>failed actions</div>

<?Relevance ((id of it, name of it) of computer of it, (id of it, name of it, time issued of it, (if exists source fixlet of it then (if baseline flag of source fixlet of it then "baseline" else "fixlet") else "action" )) of action of it) of results whose (status of it is bes action status failed) of bes actions whose (time issued of it > (now-30*day)) ?>

<div>end</div>

Some information about custom report:
http://www.ibm.com/support/knowledgecenter/SS6MCG_9.5.0/com.ibm.bigfix.doc/Platform/Web_Reports/c_creating_a_custom_report.html
You can also run session relevance on the presentation debugger on BigFix Console after enabling debug mode:
http://www-01.ibm.com/support/docview.wss?uid=swg21506082

Thank you for your reply.
I ran your comment way. I could confirm to get failed computers and baseline name.
But I couldn’t collect my request information (failed computer and the fixlet name).

1 Like

I am not sure what you mean with “fixlet name”.
When you create a baseline and then add a Fixlet to that baseline, contents of the Fixlet is copied into your Baseline. After that, when you work with your baseline, you are working with copied contents in your baseline, not with Fixlets.
When you run any baseline, all information such as relevance and actionscript come from the baseline and resulting action has no relation to Fixlets.
But, when you add a Fixlet to your baseline, name of that Fixlet becomes the name of added component in your baseline, and it becomes name of action when you run your baseline. In this sense, you have names of failed Fixlets as names of actions.

You might want something like following to show whether failed action is a member of baseline or not.

((name of it, id of it) of computer of it, (name of it, id of it, (if exists source fixlet of it then (if baseline flag of source fixlet of it then "baseline" else "fixlet") else (if exists parent group of it and exists source fixlet of parent group of it and baseline flag of source fixlet of parent group of it then "member of " & ((name of it, id of it) of parent group of it as string) else "action") )) of action of it) of results whose (status of it is bes action status failed) of bes actions whose (time issued of it > (now-30*day))

1 Like