Hi Team , We are in need of a extra custom setting in web reports to track the exact date of last patch applied on a machine and whether the system is in a pending restart state for that particular patch which requires pending restart.(If the patch does not require pending restart then data should not be displayed for that action we require only for the patch which requires pending restart as the last patch applied)
Thanks
Canara Bank Team
If you’re looking for the cumulative OS updates, maybe parsing the CBS data from the registry is an option.
Q: (preceding texts of firsts "~" of following texts of firsts "_for_" of names of it, (("1 Jan 1601 00:00:00 -0000" as time + it * second) of ((item 0 of it * 4294967296 + item 1 of it) / 10000000) of (values "InstallTimeHigh" of it as integer, values "InstallTimeLow" of it as integer)) ) of keys whose (exists value "CurrentState" whose (it = 96) of it) of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\" of native registry
A: KB5016705, ( Thu, 08 Sep 2022 04:00:05 +0100 )
T: 166.037 ms
I: plural ( substring, time )
I think this is one of those cases where you first have to figure out how to obtain the info from the OS irrespective of the tool that will be used, then try to adapt that into the inspection/reporting tool.
Thanks for solution But currently i require a custom property relevance where it will fetch the last successful patch date for both linux and windows servers from bigfix console .
Please do the needful
Thanks In advance
You will find multiple options for Windows, and the solutions already shared by @SLB should work well.
For Linux, however, there is no simple or standard way to determine the last patch date. We had a similar requirement some time ago, and the approach we ended up using was to create a text file at the end of the patching process that recorded the patch date.
Commands such as rpm -qa --last (or the equivalent package manager history) only show the most recent package installation activity, not the last operating system patch date. The last installed package could just as easily be a utility, application, dependency, or any manually installed RPM.
if (windows of operating system) then (if name of operating system contains "Win2003" then ((day_of_month of it as two digits & "/" & month of it as two digits & "/" & year of it as string) of (maximum of (date (local time zone) of time value of it) of (selects "InstalledOn from Win32_QuickFixEngineering" of wmi) whose (exists time value of it))) else if (exists (string value of selects "InstalledOn from Win32_QuickFixEngineering" of wmi) whose (it contains (regex "^[0-9a-fA-F]{16}"))) then ((day_of_month of it as two digits & "/" & month of it as two digits & "/" & year of it as string) of maximum of (((hexadecimal integer (it) / 10000000)) * second + "01 Jan 1601 00:00:00" as local time) of (string values of selects "InstalledOn from Win32_QuickFixEngineering" of wmi) whose (it as trimmed string != "")) else ((day_of_month of it as two digits & "/" & month of it as two digits & "/" & year of it as string) of maximum of ((it as date)) of ((preceding text of last "/" of following text of first "/" of it ) & " " & (preceding text of first "/" of it as integer as month as three letters)& " " & (following text of last "/" of it as integer as string)) of (string values of selects "InstalledOn from Win32_QuickFixEngineering" of wmi) whose (it as trimmed string != ""))) else (((tuple string item 2 of it) & "/" & (tuple string item 1 of it as integer as two digits) & "/" & (tuple string item 0 of it)) of (concatenation ", " of (substrings separated by "-" of (substrings separated by " " of lines whose (it contains "Done. Install/test successfully." and line number of it >= ( (it as integer) of tuple string item ((it -1) of number of lines whose (it contains "Done. Install/test successfully.") of files "/var/opt/BESClient/EDRDeployData/EDR_DeploymentResults.txt") of concatenation ", " of (it as string) of line numbers of lines whose (it contains "Done. Install/test successfully.") of files "/var/opt/BESClient/EDRDeployData/EDR_DeploymentResults.txt")) of files "/var/opt/BESClient/EDRDeployData/EDR_DeploymentResults.txt") whose (it contains "-"))))
Nice approach! However, this will only work when Linux patching is performed using the BigFix patching workflow (Plugin based).
Many orgs take a different approach. Some simply use BigFix to execute native package manager commands (example: yum update, dnf update, or zypper update), while others patch Linux systems entirely outside of BigFix using their standard enterprise patching tools or manual processes. In those scenarios, the EDR deployment logs are not created.