Symantec Management Platform (Notification Server)

Hi I want to know how it works in 7.1 Inactive Machines report.
I wonder on what basis as a reference parameter to a machine as "inactive".
Inactivity is because the object in the AD? because it sends basic inventory or configuration issues established over several days?
I do not understand how it works to the report, but I understand the logic of the SQL query that searches the data [Time Last Connected], and from it gets the status "inactive"

thanks

Looking at the SQL in the report, it is filtering out machines that haven't sent any kind of inventory data in 30 days (default). It is doing this by checking the MAX ModifiedDate for each computer in the vResourceUpdateSummary view. This view contains information about the last time each inventory class was updated per resource. If the most recent inventory class update was more than 30 days ago then that computer will show up in the results.

Hi Tyler, is there any way by which we can schedule this report? I mean is it possible to send the report to an email address after 'n' number of days?

Thanks!

Yes, you could make an Automation Police, and set the report and the scheduler task for this report using the "task" send mail.

first:

Create a Send Mail task

Go to "manage"/ "task and jobs" then you  have to clone the task "send e mail", and edit the mail, copy the link of the report, and you would go to automation Polices.

create a new police... and select the report in the query, and then select the task "send e mail" with an specific scheduler.

Right, I understand that query, but does not match the actual information, because it removes a computer from Active Directory, and turned it off.
How it works in this case report? because by the time the computer does not show me setting the number of days since I turned off the pc or more or fewer days.

example: i had the computer Pepe, and i deleted this for 14 days and i shutdown this machine. but in the report it isn´t "inactive machine"

Hi,

it will work like Tyler described. The report is based on the date/time when the machine was sending the last information to the Notification Server.

Do you have enabled the Directory Synchronization Schedule at the AD Connector? Because if it is enabled, it will check if the computeraccount is deleted in the AD and purge the corresponding object in the NS - so there might be nothing to report.

Regards,

Matthias

I do not think that is really so, and when I run I was checking the report with "0" days, I get all pc's other than the domain and the domain as well.
This is an inconsistent information. all pc's "report" information even when switched off ...
Altiris Network Discovery will be using for this report?? use some caching DNS server on Altiris and also in the DC or low talves on the router dns service?

Perhaps the main problem with this report is that it looks at all data classes, some of which probably shouldn't be included (Eg. Inv_Audit). I think some investigation into what inventory classes have been updated the most recently for that computer will help explain it for you.

Try this query (will find dataclasses updated within the last 'N' days for specified computer name):

DECLARE @NDays int
, @ComputerName nvarchar(255)

SET @NDays = 14 --set number of days here
SET @ComputerName = 'Pepe' --specify computer name here, can use '%' wildcard

SELECT c.[Guid]
, c.[Name] [Computer Name]
, dc.[Name] [Inventory Class]
, rus.ModifiedDate
, rus.[RowCount]
FROM vComputer c
INNER JOIN vResourceUpdateSummary rus
 ON rus.ResourceGuid = c.[Guid]
INNER JOIN DataClass dc
 ON dc.[Guid] = rus.InventoryClassGuid
WHERE DATEDIFF(dd,rus.[ModifiedDate],GETDATE()) <= @NDays
 AND c.[Name] LIKE @ComputerName
ORDER BY c.[Name], ModifiedDate DESC 

From the results, I'm sure you will see some data classes changed recently that you didn't expect.

IMO, the report should only be looking at the 'AeX AC...' inventory classes. Given that those are all the basic inventory data classes and if there hasn't been any data for them in the specified timeframe then the computer should be considered as inactive.

I've gone ahead and modified a clone of this report so that it only looks at the 'AeX AC...' inventory classes. You can import it and see if it provides better results. There still may be some of the 'AeX AC...' data classes that have changed recently, especially if you have done any network discoveries targeting that machine while on, or AD Imports while it was still in Active Directory recently.

The new report is attached to this thread. Let me know if you have further questions.

-Tyler

Attachment(s)

Inactive Machines - No Basic Inventory in Last 'N' Days.xml   11 KB 1 version

Hello, I run the query you have given me, and I see that keeps bringing me information "ModifiedDate, and computer name is" altirispc. "However, this computer" altirispc "is off for 14 days, do not understand why Summary report by the task resources, import rule, imported item, ou membership directory.
You have idea why this is the information?
Thank you very much!

Your computer, 'AltirisPC', was imported by an Active Directory import that ran around 12:48 today. The 7 inventory classes you see with that ModifiedTime were all updated when the data from the AD Import was stored in the database. The AD Import doesn't care if the computer is off as it imports whatever is in Active Directory.

If you are looking for a list of computers that have been off or are no longer communicating to the NS then I would recommend a report that checks for the last time a config request was sent. Reports such as this one that check the last inventory recieved will not show computers that have been off for days but are still being touched by your AD Import. This is because the AD Import touches the basic inventory tables. 

Attached is another report that looks at the last time a config request was recieved. You might find it more useful in determining if a computer isn't active or communicating with the NS.

Attachment(s)

Managed Computers Without Config Requests in Last N Days.xml   23 KB 1 version

ok, i will do this, i will use the last .xml, I just do not understand that there is a report inactive machines.

thanks 4 all.

Tyler,

What would be the correct tables to use that would show computers not reporting any HW or SW inventory?

My challenge is to try to implement a Symantec Management Agent Service Restart task for computers that are no longer reporting Inventory results.

Often times the core agent will still send basic inventory and will still perform the daily check-ins & config requests so using those fields will not work. However it will fail to process other Inventory tasks. These are the machines I'd like to target for the service restart (it's the closest thing to a simulating a reboot without actually rebooting the device).

Do you have suggestions on where to look and what to use?

Below is my attempt at this but it seems to return an outrageously high count.

SELECT ci.[Guid], ci.[Name], ir.[Collection Time]

FROM vRM_Computer_Item ci LEFT OUTER JOIN Inv_Inventory_Results ir ON ci.[Guid] = ir.[_ResourceGuid]

WHERE (ir.[Collection Time] IS NULL OR DATEADD(DAY, 8, ir.[Collection Time]) < GETDATE())

AND ir.[Agent] = 'Inventory Agent'

AND ci.[IsManaged] = 1

ORDER BY ci.[Name] ASC

Ben,

It looks correct to me. However, you could back up the data in Inv_Inventory_Results with the data in Evt_NS_Event_History. The query will run longer though. Here's the SQL:

DECLARE @days int
SET @days = 8

SELECT ci.[Guid]
, ci.[Name]
, ISNULL(ir.[Collection Time], eh.[LastInvEvt]) [Last Inventory]
FROM vRM_Computer_Item ci
LEFT OUTER JOIN Inv_Inventory_Results ir
 ON ci.[Guid] = ir.[_ResourceGuid]
 AND ir.[Agent] = 'Inventory Agent'
LEFT OUTER JOIN (
 SELECT MAX(_eventTime) [LastInvEvt], [ResourceGuid]
 FROM Evt_NS_Event_History
 WHERE ItemName = 'Inventory Solution Capture Item'
 GROUP BY ResourceGuid
 ) eh ON eh.[ResourceGuid] = ci.[Guid]
WHERE DATEADD(DAY, @days, ISNULL(ir.[Collection Time],ISNULL(eh.[LastInvEvt],''))) < GETDATE()
 AND ci.[IsManaged] = 1
ORDER BY ci.[Name] ASC