I need to trace what and when bigfix applied fixlet on 1 of our linux machine, but facing difficulty to do that.
I try to query directly to bfenterprise db, and just found some record of deleted action, but could not trace deeper what fixlet applied and when that actions running.
Is anyone can help, how to do that ?
Note: that we just do backup when do upgrading of new version, so could not restore any data to trace back and find that deleted action.
How about grab the BigFix Client logs off the linux machine itself? (assuming it has not rolled over)
1 Like
unfortunately it already rolled over on client side
All of the data of a deleted action should be in the DB, unless the audit trail cleaner was run. If the action is there, which it sounds like it is, then it is just a matter of the correct DB query to reconstitute the data you desire from multiple tables.
Already check to find any correlated data from table ACTION_FLAGS and BES_ACTIONS, but could not find any… maybe it caused the actions deleted already.
trying get back client side log and think can get the “actions id” to correlated with ACTION_FLAGS, but unluckily it rolled over too
Is there any way to get the info of that deleted actions ?
There is an ActionHistory.db in the __BESData/__Global directory which would still contain history on the client (unless the DB has been deleted) of the action. You could look at an example then inspect via the SQLite inspectors ( https://developer.bigfix.com/relevance/reference/sqlite-database.html ) and possibly find the info you need.
1 Like