I need to create a fixlet, which stops a service, renames a specific folder, and starts the service again (the folder can’t be renamed while the service is running). I need to set relevance, so that when I perform an action on the fixlet, I receive “successful” status of it and know, that it was completed successfully. I was able to write this relevance clause, which works fine:
not (exists record whose (description of it contains “Monitoring Agent service entered the running state”) of system event log)
But like this it would search the entire system log and the fixlet wouldn’t be relevant for days, once the service is restarted, before the record is erased (if the service is not restarted again in the meantime). So I need to limit it to, let’s say, 15 minutes of existence. Should be something like this:
not (exists record whose ((description of it contains “Monitoring Agent service entered the running state”) and (time generated of it is after (15 minutes before now))) of system event log)
But I don’t know how to put the “15 minutes before now” to the clause, so that it is recognisable by BigFix.
I have the same problem with second relevance clause for this fixlet:
exists (folder “C:?”) whose (modification time of it is “less than 15 minutes”)
Can someone help?