I need to create a fixlet, which stops a service, renames a specific folder, and starts the service again (the folder can’t be renamed while the service is running). I need to set relevance, so that when I perform an action on the fixlet, I receive “successful” status of it and know, that it was completed successfully. I was able to write this relevance clause, which works fine:
not (exists record whose (description of it contains “Monitoring Agent service entered the running state”) of system event log)
But like this it would search the entire system log and the fixlet wouldn’t be relevant for days, once the service is restarted, before the record is erased (if the service is not restarted again in the meantime). So I need to limit it to, let’s say, 15 minutes of existence. Should be something like this:
not (exists record whose ((description of it contains “Monitoring Agent service entered the running state”) and (time generated of it is after (15 minutes before now))) of system event log)
But I don’t know how to put the “15 minutes before now” to the clause, so that it is recognisable by BigFix.
I have the same problem with second relevance clause for this fixlet:
exists (folder “C:?”) whose (modification time of it is “less than 15 minutes”)
Can someone help?
not exist records whose (description of it contains “Monitoring Agent service entered the running state” AND now - time generated of it < 15*minute) of system event log
Recommend avoiding event log in relevance, it’s an expensive inspector.
How about checking the start time of the service’s process?
pids of service "myservicename"
processes (pids of service "myservicename")
creation times of processes (pids of service "myservicename")
Make it a Task rather than a Fixlet, or manually change the success criteria to ‘all lines of the script run successfully’. Then your Relevance isn’t used to determine success/failer.
https://developer.bigfix.com/relevance/reference/process.html#creation-time-of-process-time
Task only evaluates, if the commands were executed, but not if the actions initiated by the commands were successful, if I understand it correctly. So if the service hangs on starting, task would be evaluated as successful, even though the action itself would fail. And I need to be sure that the operation was completely successful. And unfortunately the BigFix can’t see the process for some strange reason. Clause “exists process “MonitoringHost.exe”” returns false, even though the process clearly exists. I checked for any typo very carefully. I tried that on two different servers, with the same result
Some of the process properties are not available to the fixlet debugger unless you evaluate in “local client mode”. It needs the client’s SYSTEM credentials to get that.
I remember reading about the high inspector cost of doing event logs for relevance, but I wasn’t able to find it documented anywhere yesterday.
When we have to use something from an event log, we create an analysis that’s only updated daily or so.