Sha1 analysis during a specific time window

Content Authoring
1

Hello everyone,

I’m looking for an idea on how to get an output of sha1 for some files, but also not interfere with the the once a day process that creates these files.

I have multiple machines that, in theory, all should have the same files. I want to verify that the files are the same across all machines using the bigfix sha1 analysis, but like I mentioned above, I don’t want to potentially interfere with these files which are backed up/created once a night.

Is there a relevance that will prevent the analysis from running during a certain time window?
Is there a better approach to achieving this that I am not conceptualizing?

Thank you ahead of time for anyone who has any input.

2

How big are the files?

You should just set the analysis property that gathers the SHA1 info to once every 6 hours or less often.

If the files are being created, the relevance evaluation will not interfere, it will just fail.

As far as I know, there isn’t a good way to control when the relevance in a property is evaluated, only the min frequency.

3

Less than 20 megs each, and about a dozen files. I see now the Evaluate field you are referring to in the properties tab. This should work.

That’s good to know that the evaluation will fail if the file is being written.

1 Like
4

BigFix won’t touch files that are open for writing, which is the right thing to do when it comes to SHA1 evaluation.

This is actually a bit annoying. I’d actually like the option to accept the responsibility of odd results and be able to read a file that is open for writing in some cases, particularly when it comes to Log files that are always open for writing.

See this thread: Parsing log file for date of last occurrence [Relevance]

5

Just to update this thread, new inspectors have been added for reading files that are open non-exclusively by other processes.

6

I’m unable to find anything regarding this, can you tell me more about these new inspectors?
Thanks!

7

Basically you can use
locked lines of file
to read from a locked file. The opens the file in a shared-read mode rather than exclusive-read so you can usually read things like a log file that’s still being actively written.

1 Like