Content Database

Large App Icon

I’ve just added a new feature to my BigFix.me website… the Content Database!!! Come check it out!

This side-project catalogues fixlets, tasks, and analyses into one big content database (CDB). The first available feature of the CDB is the ability to search relevance statements. Type in one or more keywords like "operating system" or "exists" and you’ll get back tons of examples of how to use those inspectors or key words within your own relevance statements. The database even knows what type of data will be returned and we sort all the results by re-use count, which can be helpful in finding the most popular statements.

If you want to contribute to the database, simply logon or register and visit our import BES content page.

You can learn more here: http://bigfix.me/cdb.

BigFix Endpoint Command Polling

Command polling is a feature built into every Tivoli Endpoint Manager endpoint.  This feature instructs endpoints to query their relay for new instructions instead of waiting the UDP ping regarding new actions.

This feature is invaluable when it comes to endpoints that are beyond your DMZ or UDP pings are not allowed.  By activating this task, you can speed up the responsiveness of your endpoints in this ping restricted locations.

Look for the “BES Client Setting: Enable Command Polling” task within the BES Support external site.

My DMZ relay is identified when endpoints communicate with my public domain name: bigfix.me.  When the endpoint talks to this relay I would like them to poll for commands every 45 minutes.  When the endpoints switch to talking to a different relay, I would like them to turn off the polling settings.

To do this I will activate two different actions.  One that is targeted at computers talking to my bigfix.me relay.  A second task will have additional relevance to differentiate them and allow me to turn off polling.

Enable Polling

Activate this action choosing the second take action option which allows us to specify the number of seconds… at 2700 or 45 minutes.

Command Polling 1

Command Polling 2

Next we’ll need to copy the “Relay” global property relevance so we can add a bit of logic to our action.

Command Polling 3

Copy the relevance for “Relay” into the clipboard and hit Cancel to close the Manage Properties window.

Command Polling 4

Returning to the Take Action dialog, specify the Preset = Policy   and select “All Computers” as the target.

Command Polling 5

On the “Applicability” tab we’ll want to modify the relevance and add the following to the end of what is there (copied from the Relay global property):

 AND (if ((it does not contain "127.0.0.1" and it does not contain "::1") of name of registration server) then (name of registration server) else if (exists setting "_BESRelay_PostResults_ParentRelayURL" of client and exists value of setting "_BESRelay_PostResults_ParentRelayURL" of client as string) then (preceding text of first "/" of (following text of first "//" of (value of setting "_BESRelay_PostResults_ParentRelayURL" of client))) else "BES Root Server") as lowercase contains "bigfix.me" AND NOT exists setting "_BESClient_Comm_CommandPollEnable" of client

Command Polling 6

After updating the relevance, we’re ready to hit OK to activate this action.

It will run on all endpoints which have “bigfix.me” within the Relay global property.

Disable Polling

Now that we have this feature getting enabled, we’ll want to disable it where it is not needed.  In other words, when endpoints are talking to any other relay except my “bigfix.me” DMZ relay.

Command Polling 7

Under the Target tab, specify all computers, configure Preset = Policy and update the name so we know this will “Disable Command Polling”.

Command Polling 8

Next we’ll move over to the “Applicability” tab as we did before and add the following slightly modified relevance from before (notice the “does not” at the end):

AND (if ((it does not contain "127.0.0.1" and it does not contain "::1") of name of registration server) then (name of registration server) else if (exists setting "_BESRelay_PostResults_ParentRelayURL" of client and exists value of setting "_BESRelay_PostResults_ParentRelayURL" of client as string) then (preceding text of first "/" of (following text of first "//" of (value of setting "_BESRelay_PostResults_ParentRelayURL" of client))) else "BES Root Server") as lowercase does not contains "bigfix.me" AND exists setting "_BESClient_Comm_CommandPollEnable" of client

Command Polling 9

After updating the relevance, we’re ready to hit OK to activate this action.

Now I will start to receive better response from endpoints communicating through my DMZ relay server.

If you have any questions or comments, please add them to the comments section below.

How to Tattoo your BigFix Endpoints

A large organization utilizing Tivoli Endpoint Manager (BigFix) has many things to do when it comes to organizing your endpoints.

Organization comes in many forms… grouping computers by: Operating System, Processor, Available Disk Space and Last Report Time are all out-of-the-box features of any BigFix infrastructure.  BUT that doesn’t make it very useful for the business side of your organization. 

To help organize your endpoints into business centric groups… we need to utilize a process I call automatic tattooing.  Tattooing endpoints can happen in many ways but they are all triggered off from properties on endpoints.  These properties can be values within INI files somewhere on the file system of your endpoints.  They can also take the form of: is a certain program installed?

For this article I will limit the scope to a few windows properties that are hidden deep within the registry.  In a later article I will help describe the process of a cross-platform tattooing method.

For my purpose I will focus on the RegisteredOrganization and RegisteredOwner string values within HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion of the Registry.

I will create a few things:

1. Two global properties which I can use within WebReports, and to help with targeting actions.

2. A task to make it very easy to configure this value using an action.

Global Properties

Crafting relevance for my two global properties is actually really easy.  In my case I’ll be reading into the registry for the values of my properties as such:

Registered Organization = value "RegisteredOrganization" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" of native registry

Tattooing 1

Registered Owner = value "RegisteredOwner" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" of native registry

Tattooing 2

Now let’s implement those within our console. 

Tattooing 3

Click on Tools->Manage Properties, Click “Add New” and specify the “Name:” and “Relevance:”.  If you have more than 100k endpoints, you may want to consider increasing the “Evaluate” property to something like “1 day” or longer.  For my tiny deployment, I will leave it at the default “Every Report”.

Tattooing 5    Tattooing 6

Once the properties have propagated, your endpoints will start to return data…

Tattooing 7

 

Configuration Task

Next up is something a tad more difficult, depending on your experience with creating custom content.  We will create a custom task which will allow us to configure these two registry values.  This task will utilize to very special commands: action parameter query, regset and regset64.  Read more about those in this document.

Let’s start with a new task:

Tattooing 8

Tattooing 9

As anybody who has read my previous articles knows, I like to fill in every blank.  It makes for a better deliverable product to customers.

Tattooing 10

The action script for this task will need to do the following things expressed in sudo-code:

Query the user for the value they want to configure for both properties.

if 64bit OS

    configure 64bit registry values

else

    configure 32bit registry values

validate

After a bit of research, our action script ends up looking like this:

action parameter query "Organization" with description "Please enter the name of your Organization (Ex: Moran IT):" and with default value ""
action parameter query "Owner" with description "Please enter the Owner’s name (Ex: Daniel):" and with default value ""

if {exists x64 of operating system}
    regset64 "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" "RegisteredOrganization]" = "{parameter "Organization"}"
    regset64 "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" "RegisteredOwner]" = "{parameter "Owner"}"
endif 


regset  "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" "RegisteredOrganization]" = "{parameter "Organization"}" 
regset  "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" "RegisteredOwner]" = "{parameter "Owner"}"

continue if {(value "RegisteredOrganization" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" of native registry) = (parameter "Organization")}
continue if {(value "RegisteredOwner" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" of native registry) = (parameter "Owner")}

Tattooing 11

Of course we can’t forget about a URL with additional detail on this task…

Tattooing 12

The relevance required to do this is actually very simple.  Since only windows computer have a “registry” we can eliminate all non-windows endpoints from running this action with the following relevance:

name of operating system contains "Win"

Tattooing 13

It is highly unlikely that a windows registry will not have the following key, but so we all learn good habits I’ve added the following relevance as well:

exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" of native registry

Tattooing 14

Let us not forget my article on Properties.

Tattooing 15

It’s been a few minutes and it looks like my fastest computers have already responded with their applicability responses.

Tattooing 16

I won’t go into detail on how to launch this task, I’ve already covered that.  Targeting is way more important to think through and understand how you are going to organize your endpoints.  In later articles I will cover other tattooing methods and how they can benefit your organizations.

For your convenience, here is a zip file containing the content covered in this article:  http://dl.dropbox.com/u/41985632/Content/Configure%20Registered%20Organization%20and%20Owner.zip

If you have any questions or comments, please leave them below.  I’d love to hear about some other tattooing methods and how you implement them within your deployment.

How to use the BigFix Software Distribution Wizard

BigFix is of course now called Tivoli Endpoint Manager a product of IBM.  I’m getting a bit lazy and calling it BigFix for short from now on.

Anyways… This article will provide helpful direction when you want to distribute software within your organization.

I have recently wrote a c# application and want to have it automatically installed across my infrastructure.  When new systems come on-line, I want my application to automatically be installed once it is properly linked into my BigFix infrastructure.  One note to be made when writing your own applications… be sure to properly register your application so you can easily detect that software on your endpoints.  I wrote an article which will show you how to properly register your app when creating your Visual Studio Setup application.

The following screen shots might help you with accomplishing this.

First we’ll need to launch the wizard itself, then specify the application name.

Distribute Windows Software 1

Here we’ll need to specify our MSI installer.  Visual studio creates both a setup.exe and a setup.msi.  the exe is a stand-alone file which creates an environment with which to launch the msi.  IE:  you can distribute the msi all by itself, but if you want to use the exe, you must distribute both the exe and msi files.

BigFix can handle, so if your application has a simple stand-alone exe, then point the wizard to it.  Or the folder or URL of the file in question.  It even has the capability of handling ZIP files.  (if you’d like more info on this, ask me in the comments section below).

Distribute Windows Software 2

Now we’ll need to specify the operating systems that our application will work on.  In my case I want to limit it to newer computers which will have my requirement of .NET to be installed.  Note:  With Windows 8 coming out soon, you may need to modify the relevance of the resulting task in order to install this application onto those endpoints.  As of v8.2 of Tivoli Endpoint Manager, we do not recognize Windows 8.  It appears in the console as “WinUnknown 6.2.8250” for the Consumer Preview Release.

Distribute Windows Software 3

Our next step is to help the wizard “craft” our relevance that will be used for this software distribution task.  Since my application follows proper registration techniques, it is as easy as specifying my executable within the Registered Application box.

Distribute Windows Software 5

Step 5 of our wizard asks us to properly craft the command line that will be used to silently install our application.  Since I’m using an msi installer file that follows Microsoft standards, the defaults are fine.  Otherwise you can change the command line parameters here.  Remember that the end user will NOT see the installer GUI.  So if the installer hangs at a certain step, it will never be noticed and you will have to manually kill the installer before the task will respond with a status.

Distribute Windows Software 6

Complete the wizard by validating the parameters and hitting Finish.

Distribute Windows Software 7

Here we have our newly generated task.  I like to fully customize my tasks, especially when I create something that will become customer facing. 

Thus I’ll work on each tab in order… First we’ll modify the description so the admin launching the task will know what this task is/does and what to expect.

Also remember to modify which site to “save” the task into and which domain it belongs to.  For more on domains, read one of my other articles covering that domains.

I also like to follow naming standards by the BigFix home office, thus on software, I’ll name it as such:  [application name] v[version number] Available

Distribute Windows Software 8

Next I like to include a URL link to the application so if the admin wants additional information or support links it’s as easy as clicking one of the actions.

Distribute Windows Software 9

The Software Distribution Wizard does a great job of creating the basic relevance that will be used.  I, however, like to separate out my relevance for easy reading.  Here I’m separating the OS relevance from my RegApp relevance.  Remember that you can only separate if they are connected by an AND, so be careful!

Distribute Windows Software 10

A final piece of “ribbon” for this task is to specify the various properties.  View my other article on BigFix Task Properties.

Distribute Windows Software 11

And there we have it… If you look under the site you specified and “Fixlets and Tasks” you will see your task.  It is unlikely that any of your endpoints have responded to your new task… therefore you may need to click the “Show Non-Relevant Content” button.

Distribute Windows Software 12

Now that you have the software distribution task created you can Activate it by following this guide.

For your convenience, here is a zip file containing the content covered in this article: http://dl.dropbox.com/u/41985632/Content/ScreenResolutionRuler.zip

If you have any questions or comments, please leave them below.

Activating a BigFix Task

The Tivoli Endpoint Manager is a fantastic way of controlling your infrastructure from one central location.  One of the most basic skills is activating a task and direct it to do something on an endpoint.  Here is a step-by-step for activating a task to perform an action on an endpoint.

First find the task you wish to activate, in my example I will be installing a service onto one of my root servers.  Select the task to be activated and click the Take Action button…

SNAGHTML1e2b905b

image

Here is our targeting screen… Since I’ll only be installing this service onto one endpoint, I’ll simply select it out of the right side computer list.  I could just as easily choose the second radio button called “All computers with the property…” which allows me to target based on endpoint properties, or even “The computers specified in the list…” which allows me to type endpoint hostnames in one line per endpoint.  Note that the third option should be limited to <100 endpoints.  If you need to target more than that you should utilize the computer groups feature.

SNAGHTML1e2e5281

I’m very happy with the defaults on this particular task, however the Execution tab will allow me to start a task at a particular time, have it run between certain hours and even control the failure/retry activities of this task.  Try not to restrict these options to much… for example, you wouldn’t want to limit the run between to 10min since the larger your infrastructure the more difficult or impossible that will be to happen.

SNAGHTML1e308c84

In some cases your action will interact with end users and you may need to prevent the action from running if no user is logged in.  The following Users tab allows you to constrain the task to only run with certain users…

SNAGHTML1e33c060

Other cases you’ll want to present messaging to the end user or even allow the user to control the processing of this particular action.  Maybe you’ll allow the user to determine when the most convenient time for them to have a particular action occur.  This screen is used for that purpose…

SNAGHTML1e34db5f

Here we have the screen to Offer the user this optional action…

SNAGHTML1e35d759

What if your action requires a restart, and you want to allow the end user delay the restart till it’s convenient for them.

SNAGHTML1e35fb3e

Rarely will you need to change the Applicability tab.   Occasionally I find it necessary to alter the default behavior of an action on a one time basis.  This tab allows me to force the installation of something ignoring the default applicability relevance of the original task.

SNAGHTML1e37de6b

If I’ve modified the applicability relevance, I’ll need to modify the success relevance as well…

SNAGHTML1e385a1f

Lastly we have the ability to modify the default Action Script of this task.
SNAGHTML1e38dc78

Once you’re all done modifying the action… click the OK button at the bottom and you’ll be asked for your credentials.  (FYI:  This is no longer the case in v8.2 unless you upgraded from a previous version or you enabled this validation step)

SNAGHTML1e39ef0e

Our task is now activated and the action status window appears.  Here we can monitor the progression of our action to each of the endpoints… on the Computers tab we can see status details on individual computers.

image

 

If you have any questions or comments, please leave them below!