Topic
13 replies Latest Post - ‏2014-07-03T19:03:18Z by AndreBordoniOliva
BenKus
BenKus
399 Posts
ACCEPTED ANSWER

Pinned topic Using BES to check if people are stealing RAM

‏2007-01-03T08:16:35Z |
One question that we get often is how people can use BES to check to see if the size of RAM has changed. The reason given is that people will sometimes steal the RAM from their computers at work and bring it home.

BES keeps various types of historical information (actions, when Fixlets became relevant/nonrelevant, statistical historical information about certain properties), but this particular task of watching the RAM change requires that you first record the RAM value and then compare it to see if it changes.

This is a pretty straight-forward set of custom Fixlets and so I put them together (they are attached).

Here are the instructions:
1. Import the two Fixlets (BES 6.0+ only).
2. Create a policy action from the Fixlet "Record Current RAM Value", which will set the current RAM size in the registry (along with the time it was recorded).
3. The Fixlet "Amount of RAM has Changed!" will become relevant if the RAM changes (it also gives you an action to reset the RAM value if necessary).

The same technique can be applied to pretty much any property (or collection of properties).

I tested this minimally and it seemed to work OK. Let me know if it works for you or if it needs some enhancements.

Ben
Updated on 2008-11-21T00:02:32Z at 2008-11-21T00:02:32Z by fnovento91
  • BenKus
    BenKus
    399 Posts
    ACCEPTED ANSWER

    Re: Using BES to check if people are stealing RAM

    ‏2007-01-03T08:29:41Z  in response to BenKus
    And to get an email alert for this (BES 6.0+ only), you can do this:

    First create the report you want and store it:
    1. Go to Web Reports. "Create" a report.
    2. Select all Fixlets. Find the "Amount of RAM has Changed!" Fixlet.
    3. Store this report.

    Then make a scheduled activity to email whenever it changes:
    4. Go to "Schedule".
    5. "New". Choose "Stored Report" and select your report.
    6. Choose "Generate Report on each refresh" and make sure the box "Send email/store archive only when report has changed" is checked.
    7. Check the "Email" box and then select the email settings that you want.

    After doing this, if someone steals some RAM, it will trigger the Fixlet to be relevant. Each time the Web Reports refreshes its information (20 minutes by default), it will see if this report has changed and if there are new computers relevant, it will email you and let you know.

    Ben
  • amitspradhan
    amitspradhan
    3 Posts
    ACCEPTED ANSWER

    Re: Using BES to check if people are stealing RAM

    ‏2007-01-08T11:57:07Z  in response to BenKus
    Hey Ben,
    This worked great for me....
    I set up the action and then the email alert feature....further we tried to have a change done onto one of the Desktop and we even got an alert for the same...thats great...
    was just thinking what could be the other aspects we can touch...any suggestiosn how this can be utilised more...
  • BenKus
    BenKus
    399 Posts
    ACCEPTED ANSWER

    Re: Using BES to check if people are stealing RAM

    ‏2007-01-09T10:11:00Z  in response to BenKus
    If you take a look at the Fixlets I made, you will see there is a relevance clause size of ram which is what gets written in the registry and then checked against. I believe it is in 3 places in the two Fixlets.

    You can replace this with any relevance expression (hardware properties, user properties, etc.) to get the same effect.

    Ben
  • fnovento91
    fnovento91
    7 Posts
    ACCEPTED ANSWER

    Re: Using BES to check if people are stealing RAM

    ‏2008-11-20T06:11:12Z  in response to BenKus
    ben,

    do i have to take action ( deploy ) the first fixlet ( record current ram value ) ?

    and the second fixlet ( amount of ram has change ) ?
  • BenKus
    BenKus
    399 Posts
    ACCEPTED ANSWER

    Re: Using BES to check if people are stealing RAM

    ‏2008-11-20T08:24:41Z  in response to BenKus
    Yes.
  • fnovento91
    fnovento91
    7 Posts
    ACCEPTED ANSWER

    Re: Using BES to check if people are stealing RAM

    ‏2008-11-20T12:05:15Z  in response to BenKus
    ben,

    i was deploying the first fixlet which set the registry of current ram

    then

    i was deploying the second fixlet,

    i'm able to received an e-mail notification from BES report, but i couldn't see the amount number of RAM that change ? is it only notified that the RAM has change without any information whether the RAM decrease / increase ? say from 512 to 256 or from 512 to 1000 ?
    Updated on 2008-11-20T12:05:15Z at 2008-11-20T12:05:15Z by fnovento91
  • Doug_Coburn
    Doug_Coburn
    3 Posts
    ACCEPTED ANSWER

    Re: Using BES to check if people are stealing RAM

    ‏2008-11-20T13:41:13Z  in response to BenKus
    Hello,

    You could create an analysis with the following property

    if ((exists value "LastRamSize" of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix" of registry) AND (value "LastRamSize" of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix" of registry as integer) != (size of ram /1024/1024)) then ((size of ram /1024/1024) - (value "LastRamSize" of key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix" of registry) as integer) as string else "No Change"
    This will return the difference between the baselined value which you can then report on.

    Doug
  • fnovento91
    fnovento91
    7 Posts
    ACCEPTED ANSWER

    Re: Using BES to check if people are stealing RAM

    ‏2008-11-21T00:02:32Z  in response to BenKus
    Sorry Doug, i'm still a beginnner in BigFix Console :)

    i'm trying to create analysis with your suggestion,

    on the property tab
    name: Change Ram value
    relevance : your suggestion
    evaluate: ?

    on the relevance tab

    what relevance should i enter ?

    thanks
    fendy N
  • CRLima
    CRLima
    1 Post
    ACCEPTED ANSWER

    Re: Using BES to check if people are stealing RAM

    ‏2014-02-26T21:48:06Z  in response to BenKus

    Hi Ben!

    Can you help me?

    Do you know how to compare two custom properties in the Scheduled Activities on  webreport  on "Match Relevance conditions"? I need to compare the values of two custom properties with clause greater than/less than.(> <).

    exists value "LastRamSize" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BigFix" of registry) AND (value "LastRamSize" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BigFix" of registry as integer) != (size of ram /1024/1024)) then ((size of ram /1024/1024) - (value "LastRamSize" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BigFix" of registry) as integer) as string

     

  • Niraj Kumar Mishra
    Niraj Kumar Mishra
    5 Posts
    ACCEPTED ANSWER

    Re: Using BES to check if people are stealing RAM

    ‏2014-04-29T13:40:02Z  in response to BenKus

    Hi Ben,

    Thanks a lot for your greatest support on bigfix. I am having a small request that we need an email notification whenever a machine is not reporting since last 30 days. That email should contains operating system along with the host name. We have windows as well unix machines.

     

    Thank you so much for your kind support.

     

    Thanks and Regards

    Niraj Kumar Mishra

  • AndreBordoniOliva
    AndreBordoniOliva
    7 Posts
    ACCEPTED ANSWER

    Re: Using BES to check if people are stealing RAM

    ‏2014-07-03T19:03:18Z  in response to BenKus

    Hi,

    I'm Encountering problem importing the file Annex, see Annex error.

    The file has a problem? Version 9.0 and 9.1 is not compliance?

    What do I need to function properly?
    Tks,

    Attachments