Monitor ram type relevance

(imported topic written by Braian)

Hi Everyone,

please help me create my relevance correct. i need to monitor if ram brand will change. i have tried below relevance with no luck.

action:

regset “[HKEY_LOCAL_MACHINE\SOFTWARE\BigFix]” “RAMbrand”="{string values of selects (“Manufacturer from WIN32_physicalmemory”) of WMI}"

relevance:

q: if ((exists value “Rambrand” of key “HKEY_LOCAL_MACHINE\SOFTWARE\BigFix” of registry) AND (value “RAMbrand” of key “HKEY_LOCAL_MACHINE\SOFTWARE\BigFix” of registry as string) = string values of selects (“Manufacturer from WIN32_physicalmemory”) of WMI) then “changed” else “No Change”

E: A singular expression is required.

Thanks,

Braian

(imported comment written by IanR2974)

Hello Brian,

The value is case sensitive so will need to read
RAMbrand where it states the first value as well.

I hope this helps.

Ian

(imported comment written by IanR2974)

Looking at the relevance the issue is it is trying to compare a single value with multiple. To resolve this you will need to use concatenation to get the multiple values on the same line.

Try this:

if (exists key “HKLM\SOFTWARE\BigFix” whose (value “RAMbrand” of it as string = concatenation of string values of selects (“Manufacturer from WIN32_physicalmemory”) of WMI) of registry) then “Changed” else “No Change”

I hope this helps

Ian

(imported comment written by Braian)

It Works, Thanks
IanR2974 for the Help.

(imported comment written by Rafael Rodriguez)

q: (if it < 10 then “0-10” else if it >= 10 AND it < 80 then “10-80” else if it >= 80 AND it < 90 then “80-90” else if it >= 90 then “90-100” else “”) of ((100 * used amount of ram) / total amount of ram) & " percent used"

(imported comment written by jgstew)

See the analysis example here:

http://bigfix.me/analysis/details/2994574

unique values
of
(values
"manufacturer"

whose
(
it

as
string
!=

“[Empty]”

AND

it

as
string
as
trimmed string does
not
start
with

“FFFFFFFFFFFF”

AND

it

as
string
as
trimmed string
!=

“”
)
of
structures
"memory_device"

of
smbios
as
string)