Relevance tuning

Content Authoring
1

(imported topic written by sowensby91)

I am trying to query our Windows servers for specific DNS server IPs. I came up with this:

(concatenation " ," of string values of selects “DNSServerSearchOrder from Win32_NetworkAdapterConfiguration” of wmi contains “w.w.w.w”) OR (concatenation " ," of string values of selects “DNSServerSearchOrder from Win32_NetworkAdapterConfiguration” of wmi contains “x.x.x.x”) OR (concatenation " ," of string values of selects “DNSServerSearchOrder from Win32_NetworkAdapterConfiguration” of wmi contains “y.y.y.y”) OR (concatenation " ," of string values of selects “DNSServerSearchOrder from Win32_NetworkAdapterConfiguration” of wmi contains “z.z.z.z”)

This works, but I have 19 IPs that I am looking for. The evaluation takes 870 + miliseconds with all 19 entries. How can I tune this relevance? Thanks.

2

(imported comment written by MrFixit)

Use of the native inspectors over WMI will save you the most.

q: concatenation “,” of (addresses of dns servers of adapters of network as string)

A: 10.8.241.101,10.8.241.100,10.8.241.100,10.8.241.101

T: 4.602 ms

I: singular string

q: concatenation " ," of string values of selects “DNSServerSearchOrder from Win32_NetworkAdapterConfiguration” of wmi

A: 10.8.241.101 ,10.8.241.100 ,10.8.241.100 ,10.8.241.101

T: 44.663 ms

I: singular string

3

(imported comment written by SystemAdmin)

If you need to get the specific order that the PC is using, you’ll need to hit the registry. It isn’t guarenteed that the order BigFix returns (when you concatenate) will be the actual order.

(all network connections concatenated)

q: concatenation “,” of (values “NameServer” of keys of key “HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces” of registry as string)

T: 0.267 ms

(just the active connection)

q: value “NameServer” of key whose (name of it = (guid of connection whose (status of it = (connection status connected)) of network as string)) of key “HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces” of registry

T: 538.684 ms

Paul

4

(imported comment written by sowensby91)

Thanks. I do not need a specific order. I just need to know what servers are pointed to these specific DNS servers.

I will try the native inspectors.

5

(imported comment written by SystemAdmin)

Just beware of your first example. You’re concatenating all of your DNS entries into 1 string and searching on that 1 string. You may come up with an incorrect answer.

Take these examples…

If I take all the IPs as 1 string and search on it, I might find something incorrect. My string is actually contained in the second string, but that’s not what I wanted. It returns true, which is not what I wanted.

q: (it contains “10.1.2.3”) of “10.1.2.34,10.1.2.4”

A: True

T: 0.022 ms

I: singular boolean

In this one, I’m keeping them as individual values. Now it correctly returns false.

q: (it contains “10.1.2.3”) of set of (“10.1.2.34”;“10.1.2.4”)

A: False

T: 0.068 ms

I: singular boolean

I think I’d rather see your first example in the format of:

exists addresses whose (it = “w.w.w.w” or it = “x.x.x.x” or it = “y.y.y.y” or it = “z.z.z.z”) of dns servers of adapters of network

-Paul

6

(imported comment written by jessewk)

Paul is definitely on the right track with his suggestion to use sets. I would use syntax like this:

(it > 0) of size of intersection of (set of (“x.x.x.x” ; “y.y.y.y” ; “z.z.z.z”) ; set of (addresses of dns servers of adapters of network as string))

Jesse