Removed Software Showing in Reports - Scan Issues

[dbkuhn]

I have a handful of Windows servers in my environment that are reporting having software installed when in fact the software has been uninstalled (and directory structure fully removed). I do have a support case opened with HCL, but figured I’d post here too.

Appears my software scans are not running correctly on these machines. Either the scan fails with an exit code -1073740791 and the action goes into a ‘Waiting’ status. Or the scans run to completion, upload their data successfully and are imported into the BFI database successfully (automatic and manual imports)…yet the software is still showing in my reports. Our DB retention is 14 days…so I’d expect these entries to disappear…(Said software was removed from the server(s) back in November/December)

Is it possible to delete the scanned data or CIT folder from the computers and re-initiate the scanner on these trouble hosts? Not really sure what to do otherwise…

Thanks,

Doug

[itsmpro92]

Which reports are you running that show the software installed (or present)?

[dbkuhn]

Thanks for responding. We are running subcapacity reports as well as software classification reports. Main issue I think is…issues with BFI scans on the hosts in question, as said software has been confirmed removed, yet still being reported in…which makes me think the scans on the hosts in question are not updating/uploaded the latest scan data to BigFIx.

And suppressing this same component on these machines in BFI is probably not the right thing to do.

[itsmpro92]

FYI - the Server Setting for Data Retention only applies to resource utilization data.

It is data related to license metrics other than PVU and RVU MAPC. If you specify retention period for resource utilization data, data that is older is removed from the IBM BigFix Inventory database.

I’ll also point out that PVU Subcapacity reports are historical in nature, and will contain data about software that was previously installed in your environment. If the software was uninstalled before the period covered by the report, it will not be included. If the software was uninstalled after the start of the reporting period, it will be included.

You can see the uninstalled software in the Software Classification report by including the column Present in your view, and removing the filter on Present which excludes uninstalled software. When the software is no longer discovered, the value of Present changes to No.

Does the uninstalled software show up as Present=No, with a Discovery End date before today?

[dbkuhn]

No, the uninstalled software still shows as present with no ‘Discovery End’ date data…which is why I think my scans on this group of servers is not working properly (and showing on my ‘missing sw scan’ list.

This brings me back to my question, is it possible to delete the scanned data (like deleting cache (I assume not) or CIT folder as a whole from the computers and re-initiate the scanner on these trouble hosts? Or just uninstall the scanner then reinstall?

Thanks!

[itsmpro92]

Ah - thanks for the explanation. Have you tried to Force Reupload of Software Scan Results (9.x.y.x) against the failing Computers?

The challenge with uninstalling/reinstalling may be a loss of continuity of data.

Perhaps run the Collect Logs from Endpoints (9.x.y.z) task against the failing Computers?

Have you made any progress on your case with HCL?

[dbkuhn]

Yep…tried that several times as well.

Waiting on a response from the HCL team on this as we speak. Will see what comes of it. Something screwy for sure here.

[Sagar_v_d]

Have you changed report period to recent one. As this report shows data from last 30days. Change the period to after uninstallation and check.

[dbkuhn]

Yes…that too. Even setting the report to a day…SW still shows. Is the clients not working and updating, I am sure.

[mtrain]

Has the MaxArchiveSize value been exceeded on your BigFix server? That would prevent changes, such as from software scans, to be uploaded to BigFix. As a result, ILMT would never get them, so the software scan results would appear to be stagnant.

Here’s a technote that explains it in the guise of “no VM Manager data”. https://www.ibm.com/support/pages/vm-managers-cannot-be-uploaded-bigfix-server-maxarchivesize-exceeded

–Mark

[dbkuhn]

Nope…not the case either. I am suspecting that there’s an issue at the OS level…as the scans on the local machines don’t appear to be even running. Particularly the ones with the error code -1073740791…working with support still on this to see if we can get to the bottom of it.

[marktagiw]

Hi Doug

Did you manage to resolve this issue? I’m experiencing the exact same problem.

Cheers

[dbkuhn]

Hi Mark,

Looking back at the case with HCL…these hosts were having issues at the OS level where they were upgraded from 2008 to 2012 and something was wrong with them and shortly after got decomm’d or rebuilt.

If you are receiving the error -1073740791, this is what the support engineer posted:

Error -1073740791 translates to hex FFFF FFFF C000 0409‬.
Error 409 is a Windows error indicating system file damage, or something like a missing dll.

Once these machines were out of my environment, all was good.

-Doug

[marktagiw]

Thanks for replying Doug. I’m starting my own support case to try and resolve the problem.

[dbkuhn]

No problem. Good luck!

[Megha_gu]

HI Mark,

Is the issue resolved ? I am facing the same issue.

[ssakunala]

@Megha_gu, this is old thread. Please start a new post and share the details of what software you are seeing, when the software was removed, when the last sw scan and upload was run on that particular machine etc