Return bes properties

Reporting
1

To get a session relevance output of the value of half a dozen or so bes properties for all computers, is there a more efficient way to get that by using “of bes properties” rather than “of bes computers”?
BES computers is taking 10min to return the results from about 30k endpoints in WR and I’m trying to speed that up. This WR has 3 datasources so I found I can’t use bes property but it needs to be a plural bes properties.

thanks

1 Like
2

That’s a very interesting wrinkle, pulling from multiple datasources…my go-to reference on efficient property query is at Efficient Session Relevance Query for Computer Properties but I think we may need to adapt it a bit to deal with multiple sources.

The main point still holds though - the biggest factor in the efficiency is in how we construct the tuple, to prevent the property object from being looked up X every computer, or the computer object from being retrieved X every property.

I should be able to post something later today, but can you give the structure of the query you are using now? You can trim it to a couple of properties if that makes posting it easier.

3

This is the “of bes computers” that I’m using today. thanks

((if (hostname of it = "") then (preceding text of first "." of hostname of it | preceding text of first "." of name of it | name of it) else (preceding text of first "." of name of it | name of it)), database name of it|"",operating system of it | "",locked flag of it as string| "",value of results (bes properties whose (name of it = "XXXX"),it) | "") of bes computers whose (exists name of it AND exists hostname of it and exists last report time of it and exists operating system of it)

4

I don’t have a large deployment handy to test on, but I think this form might improve things. Can you try it out and let me know?

q: (name of item 0 of it | "no computername", database name of item 0 of it | "", operating system of item 0 of it | "", locked flag of item 0 of it as string | "", item 1 of it, item 2 of it) of (item 0 of it, unique value of ( concatenation ";" of values of (results (item 0 of it, elements of item 1 of it)) of it), unique value of concatenation ";" of values of (results (item 0 of it, elements of item 2 of it)) of it) of (elements of item 0 of it, item 1 of it, item 2 of it) of (set of bes computers whose (exists name of it AND exists hostname of it and exists last report time of it and exists operating system of it), set of bes properties whose (name of it = "In Maintenance Window"), set of bes properties whose (name of it = "Processor Brand String"))

A: ENDPOINT-1, BES-ROOT, Win10 10.0.18362.778 (1903), False, , Intel(R) Xeon(R) CPU E7- 4870  @ 2.40GHz;Intel(R) Xeon(R) CPU E7- 4870  @ 2.40GHz;Intel(R) Xeon(R) CPU E7- 4870  @ 2.40GHz
A: BES-Root, BES-ROOT, Microsoft Windows Server 2016 or later (64-bit), False, , 
A: 192.168.1.44, BES-ROOT,  , False, ,

The expanded form of this is

 /* retrieve several properties of the bes computer (item 0), and present the property results (items 1 and 2) */
 (
   name of item 0 of it | "no computername"
   , database name of item 0 of it | ""
   , operating system of item 0 of it | ""
   , locked flag of item 0 of it as string | ""
     /* value of bes property results */
   , item 1 of it 
   , item 2 of it
 )
 of 
/* For this computer, retrieve the property results from each property set */

 (
   item 0 of it
   , unique value of 
   (
     concatenation ";" of values of 
     (
       results 
       (
         item 0 of it, elements of item 1 of it
       )
     )
     of it
   )
   , unique value of concatenation ";" of values of 
   (
     results 
     (
       item 0 of it, elements of item 2 of it
     )
   )
   of it
 )
 of 
/* Expand the bes computer set, while passing along each bes property set as-is */
 (
   elements of item 0 of it, item 1 of it, item 2 of it
 )
 of 
 (
	/* Build the set of computers from which to pull results */
   set of bes computers 
   whose
   (
     exists name of it 
    AND
     exists hostname of it 
    and
     exists last report time of it 
    and
     exists operating system of it
   )
	/* Look up the first property from which to pull results */
   , set of bes properties 
   whose
   (
     name of it = "In Maintenance Window"
   )
	/* Look up the second property from which to pull results */
   , set of bes properties 
   whose
   (
     name of it = "Processor Brand String"
   )
 )

Basically I build a set of bes computers, and a set of each bes property. A “set” qualifies as a single item as far as relevance loops go, so passing a set of 5 computers up to the next level is cheaper than moving up a level 5 times (once per computer).

Try this with your properties, and if it’s an improvement I can write up a litter further about how it works.

2 Likes
5

I removed one of the custom properties so now only returns one of the (along with the 4 other “core” properties and now it returns in all 20k rows in about 7 seconds. thank you very much

1 Like