Pinned topic Using BES to check if people are stealing RAM
BES keeps various types of historical information (actions, when Fixlets became relevant/nonrelevant, statistical historical information about certain properties), but this particular task of watching the RAM change requires that you first record the RAM value and then compare it to see if it changes.
This is a pretty straight-forward set of custom Fixlets and so I put them together (they are attached).
Here are the instructions:
1. Import the two Fixlets (BES 6.0+ only).
2. Create a policy action from the Fixlet "Record Current RAM Value", which will set the current RAM size in the registry (along with the time it was recorded).
3. The Fixlet "Amount of RAM has Changed!" will become relevant if the RAM changes (it also gives you an action to reset the RAM value if necessary).
The same technique can be applied to pretty much any property (or collection of properties).
I tested this minimally and it seemed to work OK. Let me know if it works for you or if it needs some enhancements.
Re: Using BES to check if people are stealing RAM2007-01-03T08:29:41Z in response to BenKusAnd to get an email alert for this (BES 6.0+ only), you can do this:
First create the report you want and store it:
1. Go to Web Reports. "Create" a report.
2. Select all Fixlets. Find the "Amount of RAM has Changed!" Fixlet.
3. Store this report.
Then make a scheduled activity to email whenever it changes:
4. Go to "Schedule".
5. "New". Choose "Stored Report" and select your report.
6. Choose "Generate Report on each refresh" and make sure the box "Send email/store archive only when report has changed" is checked.
7. Check the "Email" box and then select the email settings that you want.
After doing this, if someone steals some RAM, it will trigger the Fixlet to be relevant. Each time the Web Reports refreshes its information (20 minutes by default), it will see if this report has changed and if there are new computers relevant, it will email you and let you know.
amitspradhan 270004VY6G3 PostsACCEPTED ANSWER
Re: Using BES to check if people are stealing RAM2007-01-08T11:57:07Z in response to BenKusHey Ben,
This worked great for me....
I set up the action and then the email alert feature....further we tried to have a change done onto one of the Desktop and we even got an alert for the same...thats great...
was just thinking what could be the other aspects we can touch...any suggestiosn how this can be utilised more...
Re: Using BES to check if people are stealing RAM2007-01-09T10:11:00Z in response to BenKusIf you take a look at the Fixlets I made, you will see there is a relevance clause size of ram which is what gets written in the registry and then checked against. I believe it is in 3 places in the two Fixlets.
You can replace this with any relevance expression (hardware properties, user properties, etc.) to get the same effect.
Re: Using BES to check if people are stealing RAM2008-11-20T12:05:15Z in response to BenKusben,
i was deploying the first fixlet which set the registry of current ram
i was deploying the second fixlet,
i'm able to received an e-mail notification from BES report, but i couldn't see the amount number of RAM that change ? is it only notified that the RAM has change without any information whether the RAM decrease / increase ? say from 512 to 256 or from 512 to 1000 ?Updated on 2008-11-20T12:05:15Z at 2008-11-20T12:05:15Z by fnovento91
Doug_Coburn 270004VY493 PostsACCEPTED ANSWER
Re: Using BES to check if people are stealing RAM2008-11-20T13:41:13Z in response to BenKusHello,
You could create an analysis with the following property
if ((exists value "LastRamSize" of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix" of registry) AND (value "LastRamSize" of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix" of registry as integer) != (size of ram /1024/1024)) then ((size of ram /1024/1024) - (value "LastRamSize" of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix" of registry) as integer) as string else "No Change"This will return the difference between the baselined value which you can then report on.
Re: Using BES to check if people are stealing RAM2008-11-21T00:02:32Z in response to BenKusSorry Doug, i'm still a beginnner in BigFix Console :)
i'm trying to create analysis with your suggestion,
on the property tab
name: Change Ram value
relevance : your suggestion
on the relevance tab
what relevance should i enter ?
CRLima 2700068QAV1 PostACCEPTED ANSWER
Re: Using BES to check if people are stealing RAM2014-02-26T21:48:06Z in response to BenKus
Can you help me?
Do you know how to compare two custom properties in the Scheduled Activities on webreport on "Match Relevance conditions"? I need to compare the values of two custom properties with clause greater than/less than.(> <).
exists value "LastRamSize" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BigFix" of registry) AND (value "LastRamSize" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BigFix" of registry as integer) != (size of ram /1024/1024)) then ((size of ram /1024/1024) - (value "LastRamSize" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BigFix" of registry) as integer) as string
jgstew 270004VDPE18 PostsACCEPTED ANSWER
Re: Using BES to check if people are stealing RAM2014-03-07T21:59:49Z in response to CRLima
This thread is related to checking RAM, but does not address your question: https://www.ibm.com/developerworks/community/forums/html/topic?id=2e9342da-da1d-4574-9819-d816dcf0d382
Niraj Kumar Mishra 270002AXB55 PostsACCEPTED ANSWER
Re: Using BES to check if people are stealing RAM2014-04-29T13:40:02Z in response to BenKus
Thanks a lot for your greatest support on bigfix. I am having a small request that we need an email notification whenever a machine is not reporting since last 30 days. That email should contains operating system along with the host name. We have windows as well unix machines.
Thank you so much for your kind support.
Thanks and Regards
Niraj Kumar Mishra
jgstew 270004VDPE18 PostsACCEPTED ANSWER
Re: Using BES to check if people are stealing RAM2014-05-02T02:26:12Z in response to Niraj Kumar Mishra
Please post this to a separate topic, preferably in the Webreports section here: https://www.ibm.com/developerworks/community/forums/html/forum?id=11111111-0000-0000-0000-000000002699
AndreBordoniOliva 270005T1977 PostsACCEPTED ANSWER
Re: Using BES to check if people are stealing RAM2014-07-03T19:03:18Z in response to BenKus
I'm Encountering problem importing the file Annex, see Annex error.
The file has a problem? Version 9.0 and 9.1 is not compliance?
What do I need to function properly?