We are running TEM 8.2.1409 (yes, we need to upgrade, dreading it!) and one of our customers posed an interesting question. Does anyone know if there is a way, whether it be a report or a custom analysis, I could show the customer which machines took patches from their baseline over the Internet or over their corporate network?
The way the customer is configured is this; their primary Relay is on their corporate network and their backup Relay is our public facing Relay at our office. So in other words, if machines are off their corporate network and getting patches say while they are at home, they would like a report or an analysis to determine this.
I opened a case with support posing this question as well and the tech thought I might get a quicker response on here while he checks internally.
I don’t believe this can be done reliably without some kind of customization. One could try to make correlations between the execution time of a given action with the Client’s reported Relay at the time, but that will be quite difficult, and would not be guaranteed to be accurate. The Client logs would provide a good indication as to which Relay was being leveraged for a given action, and certainly relevance can help return this data, but it would be limited to the number of Client logs stored on an endpoint (by default 10 days - though the current days log is not typically inspectable). Another (longer term?) approach might be to have the actions themselves output the current Relay in a tracking file (along with the action ID) which can then be read and reported via a property.
Yeah I was thinking of the Client logs as well but realized as well the rotating 10 day deletion of the logs would get in the way. In case the customer wanted to go that route, do you know what relevance statement might pull the requested data? (I’m not too swift with the relevance authoring!)
How can I get the actions to outputthe current Relay in a tracking file as you suggested as well?
Try testing this to be added at the end of every action for tracking purposes:
dos echo {name of registration server},{id of current action} >> { (pathname of folder "__BESData\__Global\Logs" of parent folder of client) }\results_RelayOfAction.txt
That didn’t appear to work, no txt file was create and below is the client log:
At 14:31:07 -0500 -
ActionLogMessage: (action 512161) starting sub action
At 14:31:07 -0500 - actionsite (http://:52311/cgi-bin/bfgather.exe/actionsite)
Command failed (Relevance substitution failed) dos echo {name of registration server},{id of current action} >> { (pathname of folder “__BESData__Global\Logs” of parent folder of client) }\results_RelayOfAction.txt (fixlet 512161)
At 14:31:07 -0500 -
ActionLogMessage: (action 512161) ending sub action
At 14:31:19 -0500 -
Report posted successfully.
At 14:31:27 -0500 -
ActionLogMessage: (action 512159) ending group action (completed)
At 14:31:30 -0500 - actionsite (http://:52311/cgi-bin/bfgather.exe/actionsite)
Not Relevant - (fixlet:512159)
At 14:31:48 -0500 -
Report posted successfully.
At 14:40:59 -0500 -
Report posted successfully.
At 14:41:08 -0500 - actionsite (http://:52311/cgi-bin/bfgather.exe/actionsite)
Not Relevant - Post-Group Action (fixlet:512161)
Was I supposed to enter something into the beginning curly braces (name or registration server, id or current action) or would that get populated automatically?
This means that the issue was with something in the curly braces. My guess is the problem was with “{id of current action}”, because I don’t think that is correct. I really don’t know what it should be either without some investigation.