Patch Management Solution

 View Only

  • 1.  Evt_Reboot table is not populating

    Posted May 23, 2019 10:44 AM

    I'm running 8.5 and noticed that the evt_reboot table is not poplulating. From what I understand this table is used during the patch process to caputure the client's last reboot and used to get the RebootPending value from the vPMCore_RebootStatus view.  If the patch excecution time  (_eventTime.Inv_AXE_SWD_Execuation_Summary) is less the reboot time (Reboottime.Evt_Reboot) the RebootPending value is set to 0 otherwise 1.

    Because the evt_reboot table is not getting populated my report are inaccurate.

    Does anyone know how to get the evt_reboot table to populate the reboot time ?

     

     



  • 2.  RE: Evt_Reboot table is not populating

    Posted Jun 06, 2019 11:38 AM

    Thanks Igor 

    The information is much appreciated in efforts to beter understand and produce better reports of  Altiris patch process.

    However after reviewing the stored procedure and coming up with a query I am finding the DistrubtionStatus value from the Inv_Software_Update_Distribution_Status table is not always reporting a value after patch is installed. 

    Please note the NULL values from Distrubution Column from the below screenshot.

    Why would'nt the Distribution Value be poplulated with a value of 128 or 256 after a successful patch install? Also having the accurate client's last reboot value would be very beneficia in reporting..

    Your thoughts ?
     

     

     

    sql query for above query
    /* Installed Software Updates */
    select
        asu._ResourceGuid
        --vc.name [Comnputer Name]
        --,asu.SoftwareUpdateGuid
        ,su.Name [Software Update]
        ,su.RebootRequired
        ,case when isu.SoftwareUpdateGuid is null then 'Not Installed' else 'Installed' end [Compliance]
        ,case 
                when DistributionStatus = 1 then 'Invalid package'  
                when DistributionStatus = 2 then 'Ready'  
                when DistributionStatus = 4 then 'Downloading' 
                when DistributionStatus = 8 then 'Pending'  
                when DistributionStatus = 16 then 'Retrying download' 
                when DistributionStatus = 32 then 'Download required' 
                when DistributionStatus = 64 then 'Applicable' 
                when DistributionStatus = 128 then 'Installed'  
                when DistributionStatus = 256 then 'Installed by user' 
                when DistributionStatus = 512 then 'Failed'  
                when DistributionStatus = 1024 then 'Failed(rescheduled)' 
                when DistributionStatus = 2048 then 'Not applicable' 
                when DistributionStatus = 4096 then 'Scheduled' 
                when DistributionStatus = 8192 then 'Superseded' 
                when DistributionStatus = 16384 then 'Installation in progress'  
                when DistributionStatus = 32768 then 'Verification' 
                when DistributionStatus = 65536 then 'Restart pending' 
                when DistributionStatus = 131072 then 'Installed with errors' 
                when DistributionStatus = 0 then 'Undefined'
                when DistributionStatus is null then 'Unknown'
        end as 'Current State'
        ,DistributionStatus
        ,es.Status
        ,es.ReturnCode
        ,case when (',' + sit.SuccessCodes + ',') like ('%,' + cast(es.ReturnCode as varchar(50)) + ',%') then 1 else 0 end Successfull
        ,case when (es.ReturnCode = sit.RebootRequiredCode and isu._ResourceGuid is null) then 1 else 0 end RequiresReboot
        ,es._eventTime [Execution Time]
    from Inv_Applicable_Windows_Software_Update asu  
    join vcomputer vc on vc.Guid = asu._ResourceGuid
    join vPMCore_SoftwareUpdate su on su._ResourceGuid = asu.SoftwareUpdateGuid and su.IsPrimaryDownload = 1
    left join Inv_Installed_Windows_Software_Update isu on isu._ResourceGuid = asu._ResourceGuid and asu.SoftwareUpdateGuid = isu.SoftwareUpdateGuid
    left join Inv_Software_Update_Distribution_Status suds on suds._ResourceGuid = asu._ResourceGuid and suds.SoftwareUpdateGuid = asu.SoftwareUpdateGuid --asu._ResourceGuid
    left join ItemReference ir on ir.ChildItemGuid = asu.SoftwareUpdateGuid and ir.hint = 'swu'
    left join Inv_AeX_SWD_Execution_Summary es on es._ResourceGuid = asu._ResourceGuid and es.AdvertisementId = ir.ParentItemGuid
    left join ResourceAssociation sp2sif  on es.PackageId = sp2sif.ParentResourceGuid  and sp2sif.ResourceAssociationTypeGuid = '34F2B0FE-E63E-4B8E-B359-FF73A026FE51' -- Software Package Contains Software Installation File  
    left join ResourceAssociation sif2sit on sp2sif.ChildResourceGuid = sif2sit.ParentResourceGuid and sif2sit.ResourceAssociationTypeGuid = '4D33D29B-DC9F-4E72-9A80-C5FB7CEC0FB6' -- Software Installation File to Software Installation Type  
    left join Inv_Software_Installation_Type sit on sif2sit.ChildResourceGuid = sit._ResourceGuid
    where asu.SoftwareUpdateGuid in -- updates from last year
    (select _ResourceGuid from vPMCore_SoftwareUpdate where IsPrimaryDownload = 1 and DATEDIFF(MONTH,RELEASEDATE,GETDATE()) <= 12)

     

     



  • 3.  RE: Evt_Reboot table is not populating

    Posted Jun 06, 2019 05:22 PM

    Regarding the DistributionStatus value being Null.

    I did find out that the DistributionStatus value from the Inv_Software_Update_Distribution_Status table is emptied after the computer applies all the targted updates,  then sends backs the compliance information and the NS.Windows Patch Remediation Settings task schedule is ran.



  • 4.  RE: Evt_Reboot table is not populating

    Broadcom Employee
    Posted Jun 07, 2019 05:13 AM

    Hi WDRAIN1!

    "Inv_Software_Update_Distribution_Status" table 'DistributionStatus' column: 'NULL' means that this 'Software Update' is not applicable for this computer, or this Update is already installed or Patch Update policy left this computer.

    "Software Update Distribution Status" in resource manager pic above, you see 4 - reboot and 1 failed records, same you see in "Inv_Software_Update_Distribution_Status" table in 'DistributionStatus' column (Same you can see on client side in Symantec Management Agent UI, from "Software Update" tab)

    Also these records aren't remaining in this table, like pending reboot, successfull install, etc, and will be removed once data will be changed on client side, like policy removed from client, reboot is done.

    About last reboot date/time, this mostly should be gathered via inventory but not by Patch Agent (Maybe custom data class creation and custom vbs script will be good to have to get last reboot date/time of managed computer and time to time run this script to get latest information in custom data class. Your custom SQL Query just add additional JOIN to custom data class to see column with last reboot date/time.

    Regards,

    IP.



  • 5.  RE: Evt_Reboot table is not populating

    Broadcom Employee
    Posted Aug 23, 2019 07:53 AM

    Hi WDRAIN1!

    I see that you are using Patch Management Solution 8.5

    1. If your managed client computers have "Software Update Agent" 8.0.x/8.1.x/8.5 version, then they will send pending reboot event nse file in "Inv_Software_Update_Distribution_Status" table

    This stored procedure 'spPMCore_RebootStatusReport' shows report data of currently pending reboot for managed client computers with "Software Update Agent" plug-in 8.0.x/8.1.x/8.5

    Example of data in "Inv_Software_Update_Distribution_Status" table where are records about pending reboot after patch updates installation on 8.0.x/8.1.x/8.5

    'Pending Reboot' records in "Inv_Software_Update_Distribution_Status" table have DistributionStatus = 65536

     

    2. 'Pending Reboot' events will be available in "Evt_Reboot" table only from managed client computers which have "Software Update Agent" plug-in version 7.x

    This stored procedure "spPMCore_RebootStatusReport7_0" shows pending reboot records from 'Software Update Agent' 7.x

    You can check both 'Restart Status" reports for 7.1.x as well as for 8.0.x, 8.1.x & 8.5 clients. Just clone reports via mouse right click menu and go to edit mode to check which stored procedure works for them and which tables/views are parsed.

    Thanks,

    IP.