Hi!
It looks like machines that have not reported to the console in more than 30 (?) days vanish from both the console, BigFix Inventory and WebReports.
Where/how can I for instance get the date of the last report/connect of these machines?
If you are running the computer remover, you can set the expiration interval: Computer Remover
From Console, WebUI, WebReports you have to look at Last Report Time property.
1 Like
I have not run the Computer Remover.
Before I can look at the Last Report Time property I need to find these machines in some report. How to I find them? Only machines that have reported in the last 30 days show up.
Mhh, unless deleted from the Console or marked for deletion from the Computer Remover, all devices should show up. You can check directly the database for those marked for (physical) deletion:
SELECT * FROM [BFEnterprise].[dbo].[COMPUTERS] WHERE IsDeleted=1
Maybe the computer remover is scheduled and you are not aware of…
1 Like
That query does the trick, found them now!
Thanks Daniele!
Regards,
Arne
Endpoints absolutely do not disappear from the console, database, or webreports by default. If that is happening, you for sure have automation somewhere that is deleting endpoints, probably using the computer removal utility.
1 Like
The endpoints are still in the database but they are apparently tagged as deleted, and this causes them to no longer show in the console, Inventory and WebReports at least.
I suppose an earlier operator, no longer in the company, may have scheduled computer removal, how can I check?
Launch the BESAdmin tool ( c:\program files (x86)\bigfix enterprise\bes server\besadmin.exe ) check the “Clean Up” tab, under ‘BES Computer Remover’ open the Schedule and see whether there is an active schedule.
In my screenshot below, there is no active schedule so the ‘Delete’ button is disabled. If you have a schedule, you might Delete it, or change the parameters to run less frequently or allow computers for a longer duration.
2 Likes
I already did that, and there is no schedule!
This customer is a bit short on licenses, could that be the reason endpoints disappear?
No, we don’t automatically delete computers at all based on licensing.
That cleanup tab is the only automation we provide out-of-the-box to remove computers automatically. So you’ll need to be looking for either a user in the Console / WebUI, or a REST API script somewhere, that’s marking computers as deleted.
If you check your root server’s server_audit.log, you should see entries about computers being deleted, including the username and source IP address of who is doing the deletion, like this one from mine:
1|Thu, 05 Dec 2024 09:15:20 -0600|INFO|mo|CONSOLE|COMPUTER|DELETE|192.168.1.107|Computer WIN10-1(1085264668) was deleted
In my case the operator “mo”, using the ‘CONSOLE’ from IP address 192.168.1.107, deleted computer ‘WIN10-1’
1 Like
Thank you for a god tip!
I checked the log, currently the only deletes are mine from the console, and done in conjunction with rebuilds.
Will monitor that log.
Thanks,
Arne
1 Like