Report Available: Fixlet Compliance by Content

(imported topic written by Lee Wei)

Overview:

  • Given a set of Fixlets and a group of Computers, the report will calculate the total compliance, as well as the compliance for individual Fixlets.
  • This report is the same as Zak Kus’s popular MS Patch Status Report (http://forum.bigfix.com/viewtopic.php?id=865).
  • There is a sister report that provides the compliance of each Computer, rather than by each Fixlet.
  • Important! Always choose “All Computers” for the Computer Group drop list. That is fastest even for thousands of computers. Filtering by other options will slow the report significantly.

Installation:

  • Download the zip file ext-3.2.0-computercompliance16-asset12-fixletcompliance11.zip
  • Unzip to the BigFix Web Reports root directory, for example “C:\Program Files\BigFix Enterprise\BES Server\BESReportsServer\wwwroot”.

You should have a \wwwroot\ext-3.2.0 directory.

  • If the \ext-3.2.0 directory already exists, the easiest is to rename it first.
  • Create the report by going to the Reports link/tab in Web Reports.

Scroll to the bottom to find button “Import Report”

Browse to the
Fixlet Compliance by Content v1.1.beswrpt
report file in the \ext-3.2.0 directory

It is in an XML format

Requirements:

  • The report works in both Web Reports version 7.2 and 8.0.
  • The charts require Flash Player 9.0 or above.
  • The export to Excel function requires Firefox.

Bug Fixes/Enhancements:

  • 2010-08-05 v1.1 Added line 49 in compliance_by_fixlet.js that allows different treatment for computers with 0 applicable Computers
  • 2010-08-05 v1.1 Added Mark Macherey filter modifications http://forum.bigfix.com/viewtopic.php?id=5393

Notes:

  • This report is related to and uses the same library as the following reports. So as a bonus, import and try the other reports as well.

Fixlet Compliance by Computer Group v1.6.beswrpt

https://www.ibm.com/developerworks/community/forums/html/topic?id=77777777-0000-0000-0000-000014743529&ps=25

Asset Management Dashboard v1.2.beswrpt

https://www.ibm.com/developerworks/community/forums/html/topic?id=77777777-0000-0000-0000-000014743859&ps=25

Lee Wei

1 Like

(imported comment written by Lee Wei)

Additional Information:

Content Droplist Filter:

  • The Content droplist will retrieve all baseslines and sites available to the login Web Report user.
  • There are a few pre-defined selections:

All Microsoft Critical Fixlets

  • All Patches for Windows (English) critical Fixlets, excluding corrupted or superseded patches.

Microsoft Patches (Current Period)

  • Automatically calculates the Fixlets published from the Patch Tuesday to the Monday before the next period. Excludes all corrupted or superseded patches.

Microsoft Patches (Previous Periods)

  • Same as above but for 2 previous periods.

  • Custom Relevance Expression - Provides a free form entry to specify a Session Relevance that returns a list of Fixlet objects.

For example,
bes fixlets whose (name of it as lowercase starts with “ms09-065”)

This will return all Fixlets with names starting with MS09-065.

Computer Group Droplist Filter:

  • The Computer Group droplist will retrieve all computer groups available to the login Web Report user.
  • There are 2 few pre-defined selections:

All Computer

  • Straight forward retrieval of all computers. It is not a good idea to use this if there are too many computers. Always try with a smaller subset.

All Windows Computers

  • All computers with that has “win” in the operating system name.

  • Custom Relevance Expression - Provides a free form entry to specify a Session Relevance that returns a list of Computer objects.

For example,
bes computers whose (now - last report time of it < 7*day)

This will return all computers who have reported within the last week.

Compliance Grid:

The Compliance grid displays individual computer compliance status against all the Fixlets selected.

  • Meanings for the various columns:

Applicable

  • All the Computers that became relevant for this Fixlet at some point. Let’s assume that a new Fixlet is added to the BigFix system, note that Applicable will be zero because no Computers would have been evaluated as relevant. So the applicable count shows only results after the installation of the BigFix agent. Installed + Outstanding = Applicable.

Installed

  • Any Computers first detected as relevant, which are now remediated.

Outstanding

  • Computers that are still relevant.

Compliance

  • This percentage output is calculated with formula (Installed / Applicable) * 100.

  • The Export to Excel function uses a newer browser feature call Data URL. Unfortunately, the support across browsers is not consistent, and as this is written, it only works with FireFox or Safari.

  • Although the grid does paging, this is only a Client Side feature rather than true paging from the Server.

Lee Wei

(imported comment written by SystemAdmin)

Lee, another outstanding report - Thanks!

Some quick testing raised a question. We ran through the Current Period patches against a small test group of workstations. We noticed a patch (MS10-024) that applies only to MS Exchange which showed some weird “compliance” results.

Applicable Installed Outstanding Compliance

0 0 0 0.00%

Shouldn’t compliance be 100% if applicable is 0?

(imported comment written by Lee Wei)

jspanitz,

I have updated the report to behave the same way as the other compliance report, which is to use “-” to indicate non-applicable for Fixlets that have no applicable computers.

Some people prefers 0 applicable to be 0% compliant.

Some people prefers 0 applicable to be considered 100% compliant.

I have added a variable in the report so that you can switch the behavior if desired.

Change line 49 in the JavaScript file compliance_by_fixlet.js to one of the following values:

0 = 0% compliant

100 = 100% compliant

-99 = Not applicable

Lee Wei

(imported comment written by Lee Wei)

I have also incorporated the additional Content (Fixlet) filters created by Mark Macherey to the report.

http://forum.bigfix.com/viewtopic.php?id=5393

Thank you Mark for sharing.

Lee Wei

(imported comment written by rmnetops91)

Uh line 49 for me doesn’t look right. Can you tell me the specific variable so I can change it for 0 applicable to reflect 100% compliance?

(imported comment written by Lee Wei)

The variable name is “valueForZeroApplicable”.

However, it makes me wonder why this is not the same, because I have only published one version.

Lee Wei

(imported comment written by Lee Wei)

abinash posted a question about this report here:

http://forum.bigfix.com/viewtopic.php?pid=23673#p23673

Hi Lee,

how can we add patch size in detail tab of Fixlet compliance by content version1.1 ?

Abinash Kumar

(imported comment written by Lee Wei)

Hi Abinash,

The easiest way is to click on the Fixlet name or group of Fixlets (when grouped by MS bulletin) to get the details.

The details will include the download size.

The challenge that I have is that when the Fixlets are grouped by MS bulletin numbers, the download size will probably have to be a sum of all the Fixlets, and additional processing is required.

Lee Wei

(imported comment written by dhaka110091)

I have updated the report to behave the same way as the other compliance report, which is to use “-” to indicate non-applicable for Fixlets that have no applicable computers. Also incorporated the additional Content (Fixlet) filters created by Mark Macherey to the report. Thank you Mark for sharing.

how can we add patch size in detail tab of Fixlet compliance by content version1.1 ?

Thanks,

(imported comment written by Lee Wei)

dhaka1100,

Please see response above.

(imported comment written by SystemAdmin)

Lee, we are seeing some very strange behavior with this report. We updated to the latest version and are still seeing the problem. I don’t believe we have the issue before we updated to BigFix 8. The problem that we are seeing has to do with the Applicable and Installed columns. The values are way out of whack now. For instance we are seeing 2183 applicable and 2159 installed. Without going into details here, we don’t have that many clients. In the past, I thought those numbers were very reflective of actual client counts (assuming the patch applied to all our clients). Can you confirm?

(imported comment written by Lee Wei)

Hi John,

I have not heard of anything similar. We have to look into your specific scenario.

Can you take a screen shot so that I can see the report? You can send it to my email address.

Lee Wei

(imported comment written by SystemAdmin)

I just worked with Lee on this (Thank you Lee) and it was all in my eyes. I just wasn’t understanding how the report was presented.

(imported comment written by cd198391)

when running this report i get Important Information Loading… in the edit source box. This remains there and never changes. any help would be appreciated. Thanks

(imported comment written by Lee Wei)

cd1983,

This is most probably caused by not unzipping the files into the right place. The error is usually due to the report not finding the JavaScript files.

The zip goes into the folder “C:\Program Files\BigFix Enterprise\BES Server\BESReportsServer\wwwroot”.

(Or wherever the Web Reports is installed)

You should then have a folder \ext-3.2.0 underneath that as in:

“C:\Program Files\BigFix Enterprise\BES Server\BESReportsServer\wwwroot\ext-3.2.0”

You can test this by seeing if you can find a file in that folder via Web Reports:

http://:/ext-3.2.0/resources/css/ext-all.css

If you see text and css content, you have it installed correctly.

The initial load should take 3-5 seconds.

Lee Wei

(imported comment written by cd198391)

Thanks Lee. Worked like a charm. I appreciate it

(imported comment written by mbp911)

Was wondering if it was possible to pass a last report time variable in the report. Example: Only display results for machines that have checked in within the last 7 days. This is helpful as it minimizes the confussion when presenting the data to audit and secuirty teams.

(imported comment written by Lee Wei)

mbp911,

It is possible to customize the query to retrieve a group of computers for reporting.

  1. In the “Computer Group” drop list, scroll to the bottom and select “Custom Relevance Expression”.

  2. Click “Edit Custom Relevance” button to reveal the edit box.

  3. Enter the relevance statement that will return a group of computers.

This is an example of all computers reported within the last 7 days.

bes computers whose (now - last report time of it < 7*day)

All Windows computers reported in the last 7 days.

bes computers whose (operating system of it as lowercase contains “win” and now - last report time of it < 7*day)

Computers in the “Huff Building” Computer Group who have reported in the last 7 days.

members whose (now - last report time of it < 7*day) of bes computer groups whose (name of it = “Huff Building”)

Lee Wei

(imported comment written by mbp911)

Exactly what I was looking for. Thanks for your quick and detailed response. Your Awesome!