Initiate Software Scan Failing on 500 Machines

I am having trouble with the task 455336 Initiate Software Scan from the Bigfix Inventory Site. In every case the failure occurs on this statement:

appendfile { concatenation "%0a" of (unique values of (name of it as string & (parameter "SEPARATOR" as string) & (if (exists image path of it) then (preceding text of last (if (name of operating system as lowercase starts with "win") then "\" else "/") of image path of it as string) else "") & (parameter "SEPARATOR" as string) & ((year of it as string & month of it as two digits & day_of_month of it as two digits) of (date (universal time zone) of it) & (two digit hour of it & two digit minute of it & two digit second of it) of time (universal time zone) of it) of (first start time of it) & (parameter "SEPARATOR" as string) & ((year of it as string & month of it as two digits & day_of_month of it as two digits) of (date (universal time zone) of it) & (two digit hour of it & two digit minute of it & two digit second of it) of time (universal time zone) of it) of (last time seen of it) & (parameter "SEPARATOR" as string) & (total duration of it / (second / 1000)) as string & (parameter "SEPARATOR" as string) & total run count of it as string) of (instances of application usage summaries whose (not exists matches (regex"^[C|c][C|c][M|m].*[T|t][M|m][P|p]$") of name of it)))}

I can recreate the problem by copying the folder c:\Program Files (x86)\BigFix Enterprise\BES Client\__BESData\__Global\UsageData to a machine that is not having a problem. I can resolve the problem by removing all of the files in the folder.

I have tried narrowing down the file that is causing the problem by just deleting some of the files, but the problem does not seem to go away until all of the files are deleted.

I opened a case with Bigfix Inventory, but they said this is a Bigfix problem.

The issue is with the relevance provided by Inventory, so I don’t agree, but I’ll certainly see if I can figure out what is going on with this relevance.

What are the filenames in an example where the relevance fails?

What is the value of parameter "SEPARATOR" ?


I think if this relevance evaluates to 0, then that would cause the relevance to fail:

Q: number of instances of application usage summaries whose (not exists matches (regex"^[C|c][C|c][M|m].*[T|t][M|m][P|p]$") of name of it)
A: 0
T: 0.573 ms

If this relevance is 0, then it might mean that application usage isn’t being collected by the agent properly.


What is the value of _BESClient_UsageManager_EnableAppUsageSummary and/or _BESClient_UsageManager_EnableAppUsageSummaryPath on these clients with the issue?

I am working on this with the SF case opened for the issue.
When I run the above rlevance outside of the actual task/fixlet it returns nothing but does not fail (new endpoint with CIT scans running).
I will continue to work on this via the open case and will share findings with you @jgstew

Dave L

1 Like

You have to replace (parameter "SEPARATOR" as string) outside of the action for the relevance to be valid, because that part will never work outside of an action context.

I would check the 2 settings and the relevance:

number of instances of application usage summaries whose (not exists matches (regex"^[C|c][C|c][M|m].*[T|t][M|m][P|p]$") of name of it)

Also, assuming I wrote it correctly since I don’t have a test machine, this should be TRUE:

exists values whose(1 = it as integer) of (settings "_BESClient_UsageManager_EnableAppUsageSummary" of it; settings "_BESClient_UsageManager_EnableAppUsageSummaryPath" of it) of client

yup working on setting up the whole problem locally and also have a ‘bad’ version of the __BESData dir for review

1 Like

the fact that copying the data around recreates or fixes the problem does suggest that the issue runs deeper than what I mention above.

on my test machine is true.

1 Like

Here is the relevance with the separator replaced. I cannot upload the usage folder to the forum.

concatenation "%0a" of (unique values of (name of it as string & ";" & (if (exists image path of it) then (preceding text of last (if (name of operating system as lowercase starts with "win") then "\" else "/") of image path of it as string) else "") & ";" & ((year of it as string & month of it as two digits & day_of_month of it as two digits) of (date (universal time zone) of it) & (two digit hour of it & two digit minute of it & two digit second of it) of time (universal time zone) of it) of (first start time of it) & ";" & ((year of it as string & month of it as two digits & day_of_month of it as two digits) of (date (universal time zone) of it) & (two digit hour of it & two digit minute of it & two digit second of it) of time (universal time zone) of it) of (last time seen of it) & ";" & (total duration of it / (second / 1000)) as string & ";" & total run count of it as string) of (instances of application usage summaries whose (not exists matches (regex"^[C|c][C|c][M|m].*[T|t][M|m][P|p]$") of name of it)))
1 Like

did it evaluate? what about the other ones above I asked about?

Yes, I wouldn’t want you to without redaction.

These two statements return 901 and true.


  1. C|c ↩︎

it is in the usage data itself…I am looking to see what is there that could cause this.

q: concatenation “%0a” of (unique values of (name of it as string & ; & (if (exists image path of it) then (preceding text of last (if (name of operating system as lowercase starts with win) then “” else “/”) of image path of it as string) else “”) & “;” & ((year of it as string & month of it as two digits & day_of_month of it as two digits) of (date (universal time zone) of it) & (two digit hour of it & two digit minute of it & two digit second of it) of time (universal time zone) of it) of (first start time of it) & “;” & ((year of it as string & month of it as two digits & day_of_month of it as two digits) of (date (universal time zone) of it) & (two digit hour of it & two digit minute of it & two digit second of it) of time (universal time zone) of it) of (last time seen of it) & “;” & (total duration of it / (second / 1000)) as string & “;” & total run count of it as string) of (instances of application usage summaries whose (not exists matches (regex"^[C|c][C|c][M|m].*[T|t][M|m][P|p]$") of name of it)))
E: This expression could not be parsed.

I have to change the quotes as taking them from here was an incorrect character…probably just character translation within the forum and cut/paste etc.

exists values whose(1 = it as integer) of (settings “_BESClient_UsageManager_EnableAppUsageSummary” of it; settings “_BESClient_UsageManager_EnableAppUsageSummaryPath” of it) of client

Returns True.

I can narrow down the problem down to one bad file. If I remove that file, the scan will complete successfully.

L3 gave me the following relevance to put in an analysis, but it only returns none or error.

unique values of names of instances of application usage summaries whose ((not exists matches (regex"^[C|c][C|c][M|m].*[T|t][M|m][P|p]$") of name of it) AND ((not exists first start time of it) OR ((exists first start time of it) AND (not exists time (universal time zone) of (first start time of it))) OR ((exists first start time of it) AND (not exists date (universal time zone) of (first start time of it))) OR (not exists last time seen of it) OR ((exists last time seen of it) AND (not exists time (universal time zone) of (last time seen of it))) OR ((exists last time seen of it) AND (not exists date (universal time zone) of (last time seen of it))) OR (not exists total duration of it as string) OR (not exists total run count of it as string)))

In the error case, the error is <inspector interrupted>. It is not an indication of a bad usage file.

This statement lists all of the instances of application summary, but how can I add the “last time seen” to each line item?

unique values of names of instances of application usage summaries whose ((not exists matches (regex"^[C|c][C|c][M|m].*[T|t][M|m][P|p]$") of name of it))

@mbartosh To show the last time seen property for each instance, try this:

(names of it, last time seen of it) of instances of application usage summaries whose ((not exists matches (regex"^[C|c][C|c][M|m].*[T|t][M|m][P|p]$") of name of it))