The way BigFix relevance is written matters. There are usually many ways to get the same result with relevance, but generally the faster the relevance can execute, the better. The more often a relevance statement is used or evaluated, the more speed matters.
One particularly important example is using exists. Using exists actually prevents the relevance statement that follows it from fully evaluating all possible items, because as soon as there is at least 1 result, then exists is satisfied and no further evaluation is required.
Example:
The following 2 statements are equivalent. They will always return the same result in all cases.
Slower:
Q: 0 < number of descendants of (folders "C:\Windows\Temp";folders "/tmp")
A: True
T: 11.246 ms
I: singular boolean
Faster:
Q: exists descendants of (folders "C:\Windows\Temp";folders "/tmp")
A: True
T: 0.354 ms
I: singular boolean
The first example, which does not use exists, actually needs to count up every single file within the folder before comparing it to 0. This means the statement will be slower the more files there are in the folder in question.
The second example, which does use exists, does not actually get every file within the folder. Instead, as soon as descendants returns a single result, exists is satisfied and evaluation stops.
The strange part of this example is the fact that both use descendants which is an inspector that would typically return all of the file objects within the given folder. Putting exists in front of descendants like this actually changes the behavior of the descendants inspector, somehow letting it know that it only cares if there is at least one result and not all results.
Notes:
- I am using
(folders "C:\Windows\Temp";folders "/tmp")above because it is cross platform. - My preferred windows relevance of
(folders "Temp" of windows folders)does not work cross platform.
This Post:
Optimizing Bigfix Relevance: Exists
- BigFix Forum Post - make comments here
- GitHub Source File - suggest improvements here
- Website - generated GitHub Page
Similar Posts:
The Way Bigfix Session Relevance Statements Are Written Matters (part1):
- BigFix Forum Post - make comments here
- GitHub Source File - suggest improvements here
- Website - generated GitHub Page
The Way Bigfix Session Relevance Statements Are Written Matters (part2) Computer Names:
- BigFix Forum Post - make comments here
- GitHub Source File - suggest improvements here
- Website - generated GitHub Page
The Way Bigfix Session Relevance Statements Are Written Matters (part3) Whose:
- BigFix Forum Post - make comments here
- GitHub Source File - suggest improvements here
- Website - generated GitHub Page
Optimizing Custom Filters in the BigFix Console:
- BigFix Forum Post - make comments here
- GitHub Source File - suggest improvements here
- Website - generated GitHub Page
Related:
- https://developer.bigfix.com/relevance/reference/filesystem-object.html
- Speeding up API and session relevance queries
- Relevance to retrieve a set of computer objects with duplicate names
- SOLVED: Session Relevance: Extracting action results from multiple computers in an efficient way
- Sqlite inspector: read-only databases?