Topic
  • 51 replies
  • Latest Post - ‏2014-08-11T18:46:53Z by JMaple
Lee Wei
Lee Wei
599 Posts

Pinned topic Report Available: Fixlet Compliance by Content

‏2010-08-05T01:18:56Z |

Overview:

  • Given a set of Fixlets and a group of Computers, the report will calculate the total compliance, as well as the compliance for individual Fixlets.
  • This report is the same as Zak Kus's popular MS Patch Status Report (http://forum.bigfix.com/viewtopic.php?id=865).
  • There is a sister report that provides the compliance of each Computer, rather than by each Fixlet.
  • Important! Always choose "All Computers" for the Computer Group drop list. That is fastest even for thousands of computers. Filtering by other options will slow the report significantly.


Installation:

You should have a \wwwroot\ext-3.2.0 directory.

  • If the \ext-3.2.0 directory already exists, the easiest is to rename it first.
  • Create the report by going to the Reports link/tab in Web Reports.

Scroll to the bottom to find button "Import Report"
Browse to the Fixlet Compliance by Content v1.1.beswrpt report file in the \ext-3.2.0 directory
It is in an XML format

Requirements:

  • The report works in both Web Reports version 7.2 and 8.0.
  • The charts require Flash Player 9.0 or above.
  • The export to Excel function requires Firefox.


Bug Fixes/Enhancements:

  • 2010-08-05 v1.1 Added line 49 in compliance_by_fixlet.js that allows different treatment for computers with 0 applicable Computers
  • 2010-08-05 v1.1 Added Mark Macherey filter modifications http://forum.bigfix.com/viewtopic.php?id=5393


Notes:

  • This report is related to and uses the same library as the following reports. So as a bonus, import and try the other reports as well.


Fixlet Compliance by Computer Group v1.6.beswrpt
https://www.ibm.com/developerworks/community/forums/html/topic?id=77777777-0000-0000-0000-000014743529&ps=25

Asset Management Dashboard v1.2.beswrpt
https://www.ibm.com/developerworks/community/forums/html/topic?id=77777777-0000-0000-0000-000014743859&ps=25

Lee Wei

 

 

  • Lee Wei
    Lee Wei
    599 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2010-08-05T01:23:31Z  

    Additional Information:

    Content Droplist Filter:

    • The Content droplist will retrieve all baseslines and sites available to the login Web Report user.
    • There are a few pre-defined selections:

    All Microsoft Critical Fixlets - All Patches for Windows (English) critical Fixlets, excluding corrupted or superseded patches.
    Microsoft Patches (Current Period) - Automatically calculates the Fixlets published from the Patch Tuesday to the Monday before the next period. Excludes all corrupted or superseded patches.
    Microsoft Patches (Previous Periods) - Same as above but for 2 previous periods.

    • Custom Relevance Expression - Provides a free form entry to specify a Session Relevance that returns a list of Fixlet objects.

    For example, bes fixlets whose (name of it as lowercase starts with "ms09-065")
    This will return all Fixlets with names starting with MS09-065.

    Computer Group Droplist Filter:

    • The Computer Group droplist will retrieve all computer groups available to the login Web Report user.
    • There are 2 few pre-defined selections:

    All Computer - Straight forward retrieval of all computers. It is not a good idea to use this if there are too many computers. Always try with a smaller subset.
    All Windows Computers - All computers with that has "win" in the operating system name.

    • Custom Relevance Expression - Provides a free form entry to specify a Session Relevance that returns a list of Computer objects.

    For example, bes computers whose (now - last report time of it < 7*day)
    This will return all computers who have reported within the last week.

    Compliance Grid:

    The Compliance grid displays individual computer compliance status against all the Fixlets selected.

    • Meanings for the various columns:

    Applicable - All the Computers that became relevant for this Fixlet at some point. Let's assume that a new Fixlet is added to the BigFix system, note that Applicable will be zero because no Computers would have been evaluated as relevant. So the applicable count shows only results after the installation of the BigFix agent. Installed + Outstanding = Applicable.
    Installed - Any Computers first detected as relevant, which are now remediated.
    Outstanding - Computers that are still relevant.
    Compliance - This percentage output is calculated with formula (Installed / Applicable) * 100.

    • The Export to Excel function uses a newer browser feature call Data URL. Unfortunately, the support across browsers is not consistent, and as this is written, it only works with FireFox or Safari.
    • Although the grid does paging, this is only a Client Side feature rather than true paging from the Server.


    Lee Wei

  • SystemAdmin
    SystemAdmin
    890 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2010-08-05T14:23:41Z  
    Lee, another outstanding report - Thanks!

    Some quick testing raised a question. We ran through the Current Period patches against a small test group of workstations. We noticed a patch (MS10-024) that applies only to MS Exchange which showed some weird "compliance" results.

    Applicable Installed Outstanding Compliance
    0 0 0 0.00%

    Shouldn't compliance be 100% if applicable is 0?
  • Lee Wei
    Lee Wei
    599 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2010-08-05T23:15:44Z  
    jspanitz,

    I have updated the report to behave the same way as the other compliance report, which is to use "-" to indicate non-applicable for Fixlets that have no applicable computers.

    Some people prefers 0 applicable to be 0% compliant.
    Some people prefers 0 applicable to be considered 100% compliant.

    I have added a variable in the report so that you can switch the behavior if desired.

    Change line 49 in the JavaScript file compliance_by_fixlet.js to one of the following values:
    0 = 0% compliant
    100 = 100% compliant
    -99 = Not applicable

    Lee Wei
  • Lee Wei
    Lee Wei
    599 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2010-08-05T23:22:06Z  
    I have also incorporated the additional Content (Fixlet) filters created by Mark Macherey to the report.
    http://forum.bigfix.com/viewtopic.php?id=5393
    Thank you Mark for sharing.

    Lee Wei
  • rmnetops91
    rmnetops91
    17 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2010-08-23T23:43:48Z  
    Uh line 49 for me doesn't look right. Can you tell me the specific variable so I can change it for 0 applicable to reflect 100% compliance?
  • Lee Wei
    Lee Wei
    599 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2010-08-24T04:45:34Z  
    The variable name is "valueForZeroApplicable".
    However, it makes me wonder why this is not the same, because I have only published one version.

    Lee Wei
  • Lee Wei
    Lee Wei
    599 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2010-08-27T17:07:35Z  
    abinash posted a question about this report here:
    http://forum.bigfix.com/viewtopic.php?pid=23673#p23673

    Hi Lee,
    how can we add patch size in detail tab of Fixlet compliance by content version1.1 ?
    Abinash Kumar
  • Lee Wei
    Lee Wei
    599 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2010-08-27T17:13:51Z  
    Hi Abinash,

    The easiest way is to click on the Fixlet name or group of Fixlets (when grouped by MS bulletin) to get the details.
    The details will include the download size.

    The challenge that I have is that when the Fixlets are grouped by MS bulletin numbers, the download size will probably have to be a sum of all the Fixlets, and additional processing is required.

    Lee Wei
  • dhaka110091
    dhaka110091
    1 Post

    Re: Report Available: Fixlet Compliance by Content

    ‏2010-08-29T11:19:33Z  
    I have updated the report to behave the same way as the other compliance report, which is to use "-" to indicate non-applicable for Fixlets that have no applicable computers. Also incorporated the additional Content (Fixlet) filters created by Mark Macherey to the report. Thank you Mark for sharing.

    how can we add patch size in detail tab of Fixlet compliance by content version1.1 ?

    Thanks,
  • Lee Wei
    Lee Wei
    599 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2010-08-29T12:34:35Z  
    dhaka1100,

    Please see response above.
  • SystemAdmin
    SystemAdmin
    890 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2010-09-21T14:29:49Z  
    Lee, we are seeing some very strange behavior with this report. We updated to the latest version and are still seeing the problem. I don't believe we have the issue before we updated to BigFix 8. The problem that we are seeing has to do with the Applicable and Installed columns. The values are way out of whack now. For instance we are seeing 2183 applicable and 2159 installed. Without going into details here, we don't have that many clients. In the past, I thought those numbers were very reflective of actual client counts (assuming the patch applied to all our clients). Can you confirm?
  • Lee Wei
    Lee Wei
    599 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2010-09-21T19:23:39Z  
    Hi John,

    I have not heard of anything similar. We have to look into your specific scenario.
    Can you take a screen shot so that I can see the report? You can send it to my email address.

    Lee Wei
  • SystemAdmin
    SystemAdmin
    890 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2010-09-21T19:36:51Z  
    I just worked with Lee on this (Thank you Lee) and it was all in my eyes. I just wasn't understanding how the report was presented.
  • cd198391
    cd198391
    2 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2011-01-25T16:59:15Z  
    when running this report i get Important Information Loading... in the edit source box. This remains there and never changes. any help would be appreciated. Thanks
  • Lee Wei
    Lee Wei
    599 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2011-01-26T04:29:41Z  
    cd1983,

    This is most probably caused by not unzipping the files into the right place. The error is usually due to the report not finding the JavaScript files.

    The zip goes into the folder "C:\Program Files\BigFix Enterprise\BES Server\BESReportsServer\wwwroot".
    (Or wherever the Web Reports is installed)
    You should then have a folder \ext-3.2.0 underneath that as in:
    "C:\Program Files\BigFix Enterprise\BES Server\BESReportsServer\wwwroot\ext-3.2.0"

    You can test this by seeing if you can find a file in that folder via Web Reports:
    http://<servername>:<port>/ext-3.2.0/resources/css/ext-all.css
    If you see text and css content, you have it installed correctly.

    The initial load should take 3-5 seconds.

    Lee Wei
  • cd198391
    cd198391
    2 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2011-01-28T17:27:06Z  
    Thanks Lee. Worked like a charm. I appreciate it
  • mbp911
    mbp911
    8 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2011-02-01T13:16:23Z  
    Was wondering if it was possible to pass a last report time variable in the report. Example: Only display results for machines that have checked in within the last 7 days. This is helpful as it minimizes the confussion when presenting the data to audit and secuirty teams.
  • Lee Wei
    Lee Wei
    599 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2011-02-01T15:40:57Z  
    mbp911,

    It is possible to customize the query to retrieve a group of computers for reporting.
    1. In the "Computer Group" drop list, scroll to the bottom and select "Custom Relevance Expression".
    2. Click "Edit Custom Relevance" button to reveal the edit box.
    3. Enter the relevance statement that will return a group of computers.
    This is an example of all computers reported within the last 7 days.
    bes computers whose (now - last report time of it < 7*day)

    All Windows computers reported in the last 7 days.
    bes computers whose (operating system of it as lowercase contains "win" and now - last report time of it < 7*day)

    Computers in the "Huff Building" Computer Group who have reported in the last 7 days.
    members whose (now - last report time of it < 7*day) of bes computer groups whose (name of it = "Huff Building")

    Lee Wei
  • mbp911
    mbp911
    8 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2011-02-02T18:35:01Z  
    Exactly what I was looking for. Thanks for your quick and detailed response. Your Awesome!
  • mbp911
    mbp911
    8 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2011-04-18T20:42:50Z  
    Can you explain how to create custom relevance for selecting content?

    Example: All Microsoft Critical Patches From Release Date of Dec 2010.
  • Lee Wei
    Lee Wei
    599 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2011-04-18T21:15:47Z  
    mbp911
    Can you explain how to create custom relevance for selecting content?
    Example: All Microsoft Critical Patches From Release Date of Dec 2010.
    This would be the statement that you want to paste into the Custom Relevance text box.

    bes fixlets whose (
    display name of site of it = "Patches for Windows (English)" and
    source severity of it as lowercase = "critical" and
    name of it as lowercase does not contain "corrupt patch" and
    name of it as lowercase does not contain "superseded" and
    source release date of it >= "Wed, 01 Dec 2010" as date
    )
    Note that I have added the filters for corrupt and superseded patches. Please take them out if you want to see them.
    Feel free to post any other content that you need. A few examples are always easier.

    Lee Wei
  • mbp911
    mbp911
    8 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2011-04-19T19:07:29Z  
    Can you explain how to create custom relevance for selecting content?

    Example: All Microsoft Critical Patches From Release Date of Dec 2010.
  • mbp911
    mbp911
    8 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2011-04-21T19:04:39Z  
    Thanks again for your quick response. This is exactly what I needed.
  • Lee Wei
    Lee Wei
    599 Posts

    Re: Report Available: Fixlet Compliance by Content

    ‏2011-06-30T04:58:51Z  
    S.Dave
    I'm also quite confused about the way to create custom relevance for selecting content? Does anyone help me ? thanks in advance
    Stephen,

    You will have to write a Session Relevance statement that returns one or many Fixlets.
    Here is our site location for writing Relevance. This is not trivial, so it will take some time to learn the language. For now, some examples might help.
    https://www.ibm.com/developerworks/mydeveloperworks/wikis/home?lang=en#/wiki/Tivoli%20Endpoint%20Manager/page/Fixlet%20Authoring

    All Fixlets from the "Updates for Windows Applications" site that has the name "acrobat":
    bes fixlets whose (name of site of it = "Updates for Windows Applications" and fixlet flag of it = true and name of it as lowercase contains "acrobat")
    All Fixlets starting with "MS11-052":
    bes fixlets whose (name of it starts with "MS11-052")
    If you have something specific, we can help write an example statement for you.

    Lee Wei