Hi All,
In SUA Report,I have added Property “Time of last scan attempt” for some of the computers it is fetching the data and for rest of the machines it is saying no data found.
I have done the basic troubleshooting steps like Deactivating and Activating the analyses and done the import in SUA but now also i’m facing same issue.
Relevance used for Time of last scan
“if (name of operating system as lowercase starts with “win”) then (if (exists file ((if (version of client >= “9” as version) then (pathname of parent folder of data folder of client) else (pathname of parent folder of regapp “besclient.exe”)) & “\LMT\CIT\last_sw_scan_attempt.info”)) then ((it) of (line 1 of file ((if (version of client >= “9” as version) then (pathname of parent folder of data folder of client) else (pathname of parent folder of regapp “besclient.exe”)) & “\LMT\CIT\last_sw_scan_attempt.info”))) else “No information”) else (if (exists file (((if (version of client >= “9” as version) then (pathname of parent folder of data folder of client) else (pathname of parent folder of parent folder of client folder of site “actionsite”))) & “/LMT/CIT/last_sw_scan_attempt.info”)) then ((it) of (line 1 of file(((if (version of client >= “9” as version) then (pathname of parent folder of data folder of client) else (pathname of parent folder of parent folder of client folder of site “actionsite”))) & “/LMT/CIT/last_sw_scan_attempt.info”))) else “No information”)”
There are other ways to troubleshoot, but I would start with the basics - make sure the machine is working as it should within IEM, reporting in, receiving UDP messages etc. Then see it’s action history - it may simply not have received one of the tasks. Then you can start looking deeper to see if the scan has taken place, and further to that looking at the scanner diagnostics.
Take a machine that has “no data found” and inspect it’s process from start to finish. Look in it’s action history to make sure all the tasks have been successfully carried out. When you are certain everything has been applied as it should, you can then look doing some further troubleshooting.
Check to see other scan information to verify a scan has taken place. There’s an Analysis to help you look at this data (Software scan data). This will help determine if it’s that single relevance that’s not retrieving the data, or it’s working as intended and a successful scan simply hasn’t taken place yet.
You can take the relevance statement and run it locally on the endpoint using the fixlet debugger. Or you can also look at the file the relevance is queering (last_sw_scan_attempt.info). This will make sure the relevance is running correctly on the machine and successfully finding the right directory.
If your using SUA 2.2, there was an bug at some point that could cause the log file not to be created. Worth looking into if your on that version.
Check to see if any data has been retrieved from the scan - you can find this under the upload manager directory of the IEM server (UploadManagerData\BufferDir\sha1). It’s organised by the last two digits of the computer ID, and then the computer ID itself. Here you should find scan info. If there’s no information then the scan may not have happened (or the upload has not - but that would not cause the relevance to default to “no data found”)
You can also run the scanner diagnostic tool from a fixlet and retrieve the data back up to the IEM server (again stored in the UploadManagerDirectiry)
