Local Client db question

Customizations
1

(imported topic written by iLorenz)

Hi

For debugging purposes, we had to analyze the local sqlite db of the bigfix client.

Lots of interesting stuff, which helped us a lot, but also some infos which I found hard to decode.

Can someone please give us an hand? :slight_smile:

The db is ActionHistory.db, table ACTION_STATE_HISTORY

Here’s an example:

ActionID: 276770 - Self Explanatory

TotalActiveCount: 1 - ?

ActiveCount: 1 - ?

ChangeTime: 1402472346 - Last time the row was updated?

Line: 31 - Total lines of ActionScript

State: 276770::pending=0:id=276770:pt=1402468769:ct=1402468773:constrained=0:fac=1:ac=1:al=31:ast=1402468772:lal=31:lat=1402468773:lct=1402468773:wfd=0:act=0:s=Executed:pr=0:pl=0:notexpired=True:relevant=False:

Ok, the State colum needs to be further expanded:

276770: : Action ID

pending=0: - If 1 is the action yet to be executed?

id=276770: - ID …again ? why?

pt=1402468769: - Start Time?

ct=1402468773: - End Time?

constrained=0: - constrained by time/other if 1

fac=1: - ?

ac=1: -?

al=31: - ?

ast=1402468772: - Action Start Time

lal=31: - ?

lat=1402468773: - Last Action …Time?? What should this mean?

lct=1402468773: Last Change Time?? Same as above :slight_smile:

wfd=0: - ?

act=0: - ?

s=Executed: - Status: Executed should mean the row won’t be updated anymore since the action has already run?

pr=0: ?

pl=0: ?

notexpired=True: self-explanatory

relevant=False: self-explanatory

Can please someone help shed some light on the decoding?

Thanks!

2

(imported comment written by jgstew)

I’m pretty sure that the times are seconds from Epoch, though I don’t know what the Epoch is… if it is the same as Win/Unix, or if it is specific to the BigFix instance. ( I think there is a BigFix DB Epoch somewhere that is set to the initial install date of the instance, or something like that. )

3

(imported comment written by iLorenz)

Hi

Thanks for the kind reply

These are standard *nix times, we already verified that.

The puzzle lies in all these abbreviations :slight_smile:

Anyone from the devs can help maybe?

Thanks

4

I’m needing the information from ActionHistory.db decoded as well for testing purposes. Does anyone know what each of the fields mentioned above translate to?

5

I’ll have to see if its worthwhile documenting this. The issue is the format/data could change as this is an internal structure but some info can be sent.

6

Any update on this info? I’m still in need of it for a project I’m working on.

7

Have you had a chance to look into documenting this information yet? Even if it were just a snapshot of what it currently represents it would be sufficient, it doesn’t need to be updated/verified at any set interval.

8

Looking at the client inspector documentation for the Action object, I was able to map the majority of the properties contained within the Status field of the ACTION_STATE_HISTORY table of the ActionHistory.db file. Here’s what I found:

These are mapped and had “official” descriptions of the inspectors:

Pasted image701Ă—629 10.6 KB

I found inspectors for these by using “introspectors” but found no “official” documentation:

There’s also these entries that have no corresponding inspector:

Now that I’ve greatly narrowed down the questions, can someone please respond to the items with question marks?