One Analysis for All Applications

We have created a single analysis that has a property for each one of our applications. Is this a good practice or would it be better to have separate analysis for each property? I don’t really see an advantage to having all of the applications in one analysis other than you can go to one analysis and see all of the applications, but you loose the search capability.

One concern I have about the one analysis approach is when one property is edited and then the analysis is saved, does that trigger an immediate evaluation of all of the properties in the analysis. We currently have 17 properties in the analysis, but that could easily grow to 50 or more. The properties have varying evaluation times.

I just realized that this approach doesn’t scale.

I believe that since each property in the Analysis has it’s own Reporting Period, updating the Relevance for one of the Properties will not effect the others.

In fact, I don’t believe that editing the Relevance for a “given” property will impact the reporting for the “given” property itself.

If you have a property that only reports once a day, and you edit it, you will need to wait 1 day for all the updated results.

The only way I know to “reset” the reporting periods for the properties is to Deactivate then Activate the Analysis. That will cause the clients to discard their status for the properties and their reporting periods.

What do you think of this approach with one analysis for all applications? Is it more efficient? Is it something you do in your environment.

There isn’t a single recommendation here, but you are thinking about the right things. Tim is correct about the impact on property evaluation, so that part isn’t a concern, but you do want to think about useability and growth. It is definitely more efficient to have multiple properties in a single analysis vs many analyses with only one property. But if you expect the number of properties to grow to 50+ then it makes sense to start breaking them down into smaller analyses.

The main concern would in trying to view the property results in the console, where a user would look at the analyses to view one or two of the properties, but the console will have to load results for all 50 properties which will take longer, use more memory and increase the cache size (which would mean more data to load on the next console startup). If you split up the analyses, would you be able to use more precise relevance such that fewer systems would need to evaluate some/many of the properties? Are their logical groupings of the applications that users are likely to want to view together (e.g. security apps, core apps, custom apps)? I try to limit analyses to around 15-20 properties just from a usability perspective.

I am not following the part about loading 50 properties into the console. The only properties you see in the console view are the properties that are selected. Whether or not all properties are in one analysis or many analysis, the properties still are selectable.

The memory usage of the console is related to the Retrieved Properties (of which all are loaded into the console when it’s started) and Analysis Properties, which are loaded whenever they are opened, therefore, the memory load in the console is linked to how many Analyses you have open at any time (along with RP’s, open fixlets, viewing of actions, etc.

Therefore, you should keep this in mind when thinking about how many properties you want to include in a single Analysis.

If you only plan to view the properties by adding them as a column to the Computers view, then that is correct. If you want to view a few of them, and don’t want to add them as columns, then you would open the analysis and it would cause all 50 properties to load at that time.

When you edit the Analysis, behind the scenes a new analysis activation FXF file is made in the actionsite of the operator and the old one is deleted, so it is very possible that the periods were all reset every time you edit the Analysis as the activation is where the “period” information will be stored of the last time it was evaluated.

In my experience I can refresh the results of an analysis by editing, then saving the analysis, regardless of the report period of the individual properties.