Hi,
I have two reports going out daily. One shows computers with no Symantec anti-virus service running, and the other shows if the virus defs are over 3 days old.
Is there a way to get the scheduled report only to send out an email if the report is NOT empty or null?
I’ve tried multiple relevance statements and none are working. The relevance in the BigFix console works fine, but as a scheduled report it’s not working. I basically want it to state if there are no results in the report, don’t send it.
Thanks for this info. I have so much to learn. Is there a good spot to read up on session relevance, I am not familiar with this, or how to even go about writing that relevance to show computers in the report > 0?
Client relevance runs on the client. It retrieves information about that client, but knows nothing of any other client that reports to your Bigfix server.
Session relevance runs on the server and retrieves information from the Bigfix database. it is this information that is used in Web Reports, Dashboards etc. You can read up on it here https://developer.bigfix.com/relevance/guide/session/
Also, you may need to adjust the Scheduled activity itself because even if you get the session relevance correct and there is nothing in the report, it may still send you blank emails…
Have a look at “Match Relevance conditions” and the three radio buttons when you enable it and you may need to add some kind of clause like this:
exists results whose (exists values whose (it as time < now - 3 * day) of it) of bes properties whose (name of it = “AV Definition Date”)
exists results whose (exists values whose (it as string != “Running”) of it) of bes properties whose (name of it = “AV Status”)
Thanks for this information. I am embarrassed to admit, I spent a good portion of today trying to get this to work, but I have not had success. Perhaps I am going about it the wrong way? I’ve read through all the session relevance documentation and additionally tried the relevance conditions (with my appropriate wording) and I cannot get anything to work. I was going for something simple, like when the number of computers in the report is > 0, but I can’t seem to get that to work.
The Definition relevance assumes that you have the data in the AV Definition Date property in exact BigFix time format, if that is not the case you may need to adjust the format before you can do that date comparison operation.
This is the formatting of time, which you need your data to be in before “it as time < now - 3 * day” works:
q: now
A: Fri, 28 Aug 2020 02:41:16 -0500
q: (“Mon, 24 Aug 2020 02:41:16 -0500” as time) < now - 3 * day
A: True
Let’s say your data is in format of is just date “MM/DD/YYYY” or date & time in “MM/DD/YYYY HH:mm:ss”, then you need to convert it to BigFix time format first and then use the converted value in any comparison statement. There are plenty of resources and examples both here in the forum and bigfix.me of date/time conversions if you need help with that.
Hi,
Thanks for that response. This is what my property looks like to find out if the virus def date is over 3 days old. It returns either a true or false
(current date - 3*day > it) of (date it) of (tuple string item 2 of it & " " & tuple string item 1 of it as integer as month as three letters & " " & tuple string item 0 of it) of concatenation ", " of substrings separated by “-” of (value “LatestVirusDefsDate” of it as string as trimmed string) of key “HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\public-opstate” of registry
Side note, still struggling. Seems this should be easier, but obviously I’m having a hard time catching the difference between relevance for client and session.
Thanks, though, for your help. I’ll keep trying to get it.
If your property is already taking care of the date calculation (and it already gives you True/False) then you do not need to do anything on the trigger side and something like this should take care of it:
exists results whose (exists values whose (it as boolean) of it) of bes properties whose (name of it = “AV Definition Out-of-Date”)
Brilliant! That worked!! I would not have gotten that on my own.
SO, any thoughts on what the relevance would be when all servers are running the SepMasterService? I am just using the built-in property “running services” and the report lists out computers that do not have “SepMasterService” in the “running services” list. I only want it to send us an email if a computer shows up on the report.
I thought this would work, but it’s not working:
exists results whose (exists values whose (it as string) of running services whose (name of it = “SepMasterService”))
There is a difference between “session relevance” and “client relevance”. The former is essentially executed by Web Reports on “system side” if you will; the latter is relevance that is evaluated on each machine by the agent. So you essentially write your client relevances, plug them in properties for the clients to evaluate and report into the root server; Web Report then caches that entire pool of data and you run session relevances against that data to pull the results in your reports. Session relevance supports results of bes property but it won’t support “running services”; and vice-versa for client relevance.
I have tried this, but no luck:
exists results whose (exists values whose (it as string != “Running”) of it) of bes properties whose (name of it = “SepMasterService”)
True/False. That is what triggered my ‘brain’ so thank you for that! I now have it working (I was thinking it was the running service but I guess i needed more)