7 Replies Latest reply on Mar 1, 2011 9:27 AM by Jim Campbell

    Best method for reporting Registry Key values

    Jim Campbell

      This seems like it would be such a common task, but I can't find anything that talks about how to run reports against a server inventory for the values of registry keys.  We get asked to do this all the time and usually have to manually cobble together audit reports (some of which now refuse to export because I guess they are too large).  The usual task is something like: out of 4000ish servers, 500 or so will have application_x.  All of these will have a registry key but on some it may be any empty value.  Find a list of the servers that don't have the key, have the key but its empty, and the list of servers along with the values where the key is set.

       

      We can use nsh scripts to output this but its cumbersome at best and I have to think there's a way to get this information from BSARA.  Putting the keys in our inventory snapshot job caused it to output errors for every server on which it did not find the appropriate key.

        • 1. Re: Best method for reporting Registry Key values
          Gerardo Bartoccini

          You could create a template where the only part is you registry key, and also the registry is the signature, something like:

           

          must exist

           

          When you discover servers, components will be created only if the key is present, so your snapshots won’t fail.

          • 2. Re: Best method for reporting Registry Key values
            Jim Campbell

            Ok I've done this with a registry key on 3 test servers.  It properly discovered the component on the two servers on which the registry key existed.  How do I get the snapshot data to propagate into the BSARA data warehouse?  If it does so automatically and since ETL has run several times, where do I find the information for this specific registry key in the report data?

            • 3. Re: Best method for reporting Registry Key values
              Gerardo Bartoccini

              I just noticed my text missed some '<>' tags. I'm happy you understood anyway :-)

               

              If you take a snapshot on a component, it gets automatically populated into BSARA DB at next ETL run.

               

              After that, create a report and drag and drop entries from Inventory/Common/Extended Object (select Record Name and Column1, Column2, etc.)

               

              You will have to filter report based on your template name

              • 4. Re: Best method for reporting Registry Key values
                Jim Campbell

                I ran discovery, generated the components with the registry keys, and snapshotted them on 24 Feb.  ETL has run successfully at least once (confirmed on the 26th from both OM and Metadata Navigator).  From BSARA, when I drag any value (Extended Object Name, column1, Path, Record Number, etc) from Inventory/Common/Extended Object all i get is "No data available".

                 

                We've never actually gotten anything we've snapshotted to show in BSARA, so we must be missing something.

                • 5. Re: Best method for reporting Registry Key values
                  Gerardo Bartoccini

                  Sorry Jim, my fault.

                  Drag and drop your data from

                   

                  Inventory/Windows/Registry

                  • 6. Re: Best method for reporting Registry Key values
                    Jim Campbell

                    Inventory/Windows/Registry is what I had initially tried.  If I try to drag anything from there (Name of the registry key e.g.) it hangs indefinitely (the BSARA hourglass of doom).

                     

                    I've tried adding server name and filtering it down to one server and then adding in the registry fields, but even in that case it usually hangs.  It did come back with a result once, but it was just the servername and a backslash.

                    • 7. Re: Best method for reporting Registry Key values
                      Gerardo Bartoccini

                      I see. Ok, one last solution: create an extended object which will query the registry.

                      You can use blquery for this (have a look to the manual - “man blquery” from NSH)

                       

                      This should work:

                      Create an extended object with Central execution, and enter this as your command:

                       

                      blquery -h ??TARGET.HOST?? -e reg_value ("HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\bounds")

                       

                      (edit the registry key as required)

                       

                      (USE double back slashes for your registry key)

                       

                      Take a snapshot and build your report with data from Inventory/Common/Extended Object

                       

                       

                      PS: use the EO for the snapshot, and the registry key itself (the one you have been using so far) for the discover.

                      • 8. Re: Best method for reporting Registry Key values
                        Jim Campbell

                        After talking with support on a similar issue, my mistake with using the Inventory/Windows/Registry information looks to have been using singleton queries rather than lists.  I ran into a new problem, but it looks like the method you have detailed is working.

                         

                        I'm not sure if anyone else has run into this problem, but the test registry key i chose was a multi-string datatype.  Has anyone else run into problems with reporting on these?  I tried with a normal string registry key and was able to get the information for it, but it gives what appears to be encoded gibberish in BSARA when I try to pull a multi-string value.  It does show up in the output of the snapshot job as it should, however.