Who's deleting machines from the console?

Content Authoring
1

I need to know which one of my Operators is deleting machines from the BigFix Console. Is there a way to find this out?

Thanks.

Sno

2

@Snojack, yes… on the Root BES server you’ll want to retain and archive off the server_audit.log and any server_audit.yyyyMMddTTTTTT files too. In this file you’ll see entries that include the operator’s username, timestamp and hostname and BES ID of the endpoint deleted from the console.

Also, please note that until the BESAdmin Computer Remover runs and hits the configuration for retention… these endpoints still exist in the BFEnterprise database. There’s an “IsVisible” flag in the computers table that you can flip to make the endpoints to show up again assuming they’re no longer reporting.

Hope this helps.

2 Likes
3

thanks for the help!

1 Like
4

Also, note that if the computers are still online and able to report to the BigFix infrastructure they will re-appear in the console by themselves(If the cert hasn’t been invalidated/revoked), after they send reports back to their parent relay.

2 Likes
5

thanks alot for the feedback, appreciate it.