Relevance Tips

This page has not been liked. Updated 10/16/14, 2:29 PM by SteveHullTags: None

Use this page to post relevance tips and tricks.

 

Querying HKEY_CURRENT_USER branch of registry

Since the BigFix Agent runs as the SYSTEM account, when you write relevance that accesses the "HKEY_CURRENT_USER" branch of the registry, the agent will query the SYSTEM account's HKCU rather than the logged in user's HKCU (note that this is different from what you see in the Relevance Debugger, which will return results from the HKCU of your logged on user). To help query the local logged on users' HKCU branch of the registry, there is an inspector "current user keys" that can be used:

q: exists key "Software\BigFix" of current user keys (logged on users) of registry

A: True

 

Introspectors!

These relevance inspectors let you query the relevance language. It is a self documenting feature and is a very powerful way to discover new inspectors in the newest versions of TEM while you wait for the official documentation to be released.



Properties that return folder objects (creation methods). This asks "How do I create Folder Objects?"

q: properties returning (type "folder")

Query all properties of an object type. This asks "What can I query about a Folder Object?"

q: properties of type "folder"

Introspecting the Introspectors.

q: (it, result types of it, direct object types of it) of properties whose (result type of it as string = "property" or direct object type of it as string = "property")

Not sure what property types there are? Try pulling all types:

q: unique values of (result types of properties as string)

 

Error Trapping shortcut in 8.x

in 7.x and earlier, in order to have good property and analysis results, we would catch existence errors lke this:

q: <property> of <foo> as string

E: Singular expression refers to nonexistent object.

q: if (exists <foo>) then (<property> of <foo> as string) else ("Missing foo")

a: Missing foo

New in 8.x you can use the new "or" formulation using the pipe character to catch your error gracefully

q: <property> of <foo> as string | "Missing foo"

 

Resolving Inspector Evaluation Errors

All relevance inspectors should work by default within the Fixlet Debugger just as they do within the IEM Client, with 2 exceptions:

1. Some inspectors (usually content related, like fixlets) must be run within the client context, or will return the error 

E: No inspector context.

To use these inspectors in the Fixlet Debugger, change the evaluation context by selecting Debug -> Evaluate Using -> Local Client Evaluator.

2. Some inspectors require LocalSystem permissions in order to return valid information.  The IEM Client runs as the SYSTEM account and has this authority, by default.  If permissions errors occur or incomplete/different data is returned in Fixlet Debugger vs the Client, use a utility like psexec to run the Fixlet Debugger as the SYSTEM account: e.g. psexec -s -i FixletDebugger.exe

 

Version of TEM (session relevance)

Q: version of datastore inspectors

A: 8.2.1093.0

 

Ordinal Date (sometimes incorrectely called Julian Date):

q: (it - ((january 01 of (year of it as integer))-day)) of current date

A: 87 days

Constructing the string with year included and padding the day of year with leading zeros as in YYYY-DDD format:

q: (year of it as string & "-" & last 3 of ("000" & (((it - (january 01 of (year of it as integer)-day))/day) as string))) of current date

A: 2012-087

Or for the "real" Juilan Day (as per the formula on wikipedia: http://en.wikipedia.org/wiki/Julian_day)

q: (day_of_month of it as integer + (((153 * ((month of it as integer) + 12*((14 - month of it as integer)/(12 as integer)) -3))+2)/5) + (365 * ((year of it as integer + 4800) - (14 - month of it as integer)/(12 as integer))) + (((year of it as integer + 4800) - (14 - month of it as integer)/(12 as integer)) /4) - (((year of it as integer + 4800) - (14 - month of it as integer)/(12 as integer)) / 100) + (((year of it as integer + 4800) - (14 - month of it as integer)/(12 as integer))/400) - 32045) of current date

or done with tuples to more closely map to the published equation.

q: (day_of_month of item 2 of it as integer+ ((153* item 1 of it) +2)/5 + 365 * item 0 of it + item 0 of it / 4 - item 0 of it /100 + item 0 of it / 400 - 32045) of ((year of item 1 of it as integer) + 4800 - item 0 of it, (month of item 1 of it as integer + (12* item 0 of it) - 3), item 1 of it) of ((14 - month of current date as integer)/(12 as integer),it) of current date