11 Replies Latest reply on Jan 12, 2012 1:35 PM by Bill Robinson

    audit a service

    Erez Frenkel

      Hi All,


      We work with BBSA 8.1.2


      We run audit against one service, and we noticed that the inconsistent can be for the service status like : stopped / running, and also for the binary path - program files or program files (X86)



      1.          Can we receive inside the email audit message the description of the inconsistent? (we want to know if it's stopped)



      2.          We would like to see only the service status, and all the others inconsistent  with the binary path it's not important for us


      Any ideas?





        • 1. Re: audit a service

          Yes, there is an option in the job 'Audit Results Notification' where  you can select email the results of the job for consistent or inconsistent results or both.

          This shld be under default notifications section of the Audit Job.

          • 2. Re: audit a service
            Erez Frenkel

            Hi Rohit,



            Please find I attached the audit email result , us you can see there is no any details regarding why

            It inconsistent,


            Please let me know if you have any idea





            Here is the email:



            Subject:Job "Audit BES Service" (Status: inconsistent)


            AuditJob Notification


            Jobid: 2000221

            Name:Audit BES Service


            JobGroup id: 2002400

            JobRun id: 2007010

            StartTime: Thu Dec 22 15:35:56 IST 2011 End Time: Thu Dec 22 15:36:02 IST 2011



            Master:(Component) Audit BES Service(HFAVWPNTP002)


            ****************  inconsistent Servers/Snapshots   ********************


            (Component)Audit BES Service(HFAVWBLFP001)


            ****************  Breakdown of inconsistent assets   *****************


            Audititem:  BES Client

            Servers/Snapshots: (Component) Audit BES Service(HFAVWBLFP001)

            • 3. Re: audit a service
              1. AFAIK, there is no option to add data from the job results to the email notification. Aworkaround might be to export the job results. In case you wnat to automate the process you can use BLCLI, under Utility name space there are severaloptions to export the audit job results (Utility exportAuditRun, Utility simpleExportAuditRun, Utility simpleExportAuditRun).
              2. In case you want to see only some of the audit attributes, you can mark the snapshot/Audot options in the job definition. In the specific case of the Windows Service I noticed that all the options are marked and disabled. I'll further check it to see if it is configurable in another palce.
              1 of 1 people found this helpful
              • 4. Re: audit a service
                Erez Frenkel

                Hi Nimrod,


                I try to run the simpleExportAuditRun command for my audit job, in order to receive the export of the audit job (csv format) but I got an error,


                The audit folder is /Audit

                The audit job name is: Audit-alerter


                I try the following steps:


                1. E:\>blcli -v bbsa813 -r BLAdmins AuditJob getDBKeyByGroupAndName /Audit "Audit-alerter"




                2. E:\>blcli -v bbsa813 -r BLAdmins JobRun findLastRunKeyByJobKey DBKey:SJobModelKeyImpl:2-3-2002899




                3. E:\>blcli -v bbsa813 -r BLAdmins Utility simpleExportAuditRun "/Audit" "Audit-alerter" DBKey:SJobRunModelKeyImpl:20-2002954 "E:/temp/sampleJobResult.csv" "Size,Checksum"


                Unknown command : name space = 'Utility', command = 'simpleExportAuditRun'.com.bladelogic.om.infra.cli.factory.CommandNotFoundException: Found command 'Utility.simpleExportAudit

                Run' but with mismatching arguments. : java.lang.IllegalArgumentException: Input 'DBKey:SJobRunModelKeyImpl:20-2002954' cannot be converted to expected type : int: java.lang.Num

                berFormatException: For input string: "DBKey:SJobRunModelKeyImpl:20-2002954"


                What am I missing here?

                • 5. Re: audit a service

                  The command failed since it expects the job's run ID (int type) and not run DBKeyey. To convert the run DBKey you need to use the next BLCLI: JobRun jobRunKeyToJobRunId.

                  You can use the next script file to do the whole process - just update the data set section at the beginning of the script (instead of writing commands one by one, you can delete the echo commands - it is for 'debug' purposes ):



                  ROLE="Copy of BLAdmins"





                  JOB_DBKEY=`blcli -v $PROFILE -r "$ROLE" AuditJob getDBKeyByGroupAndName $JOB_FOLDER $JOB_NAME`

                  echo "JOB_DBKEY=$JOB_DBKEY"

                  RUN_KEY=`blcli -v $PROFILE -r "$ROLE" JobRun findLastRunKeyByJobKey $JOB_DBKEY`

                  echo "RUN_KEY=$RUN_KEY"

                  RUN_ID=`blcli -v $PROFILE -r "$ROLE" JobRun jobRunKeyToJobRunId $RUN_KEY`

                  echo "RUN_ID=$RUN_ID"

                  RESULT=`blcli -v $PROFILE -r "$ROLE" Utility simpleExportAuditRun $JOB_FOLDER $JOB_NAME $RUN_ID $EXPORT_FILE_NAME $COLUMNS`

                  echo "RESULT=$RESULT"


                  I see that you are using BLAdmins role - it is not recommended since this role has the whole prvileges (kind of super user).


                  About your second question (selecting only some of the options for the audit), it is a design change and I'm checking what's the best way to do so. Will update you.

                  • 6. Re: audit a service

                    Hi Erez,

                    I checked what can be done with the audit options selection - adding the selection of options in the audit job of windows services (instead of all selected by default and selection is disabled) is a design change which requires a change request. To do so, there are two options:

                      1. You (as a customer) can open this as an issue w/support and they would create the Request for enhancement. In that way you can monitor this request and maybe get it as a hotfix/patch.
                      2. I (as BMC dev team) can create the request by myself (IMHO its priority will be lower then a request issued by customer).

                    Please let me know what's the best option from your side.

                    • 7. Re: audit a service
                      Erez Frenkel

                      Hi Nimrod,


                      I will open this as an issue w/support


                      Any idea why the manual export have all the information regarding the audit,

                      but the automatic script doesn't?



                      Here is the manual export:

                      Configuration Manager Audit Export


                      Date:,Wed Jan 04 11:26:09 GMT+02:00 2012

                      Job Name:,Audit-alerter

                      Master:,snapshot alerter (bbsa813) - 2012/01/02 12:33:08+0200

                      Objects Audited:,Service (Windows Service)

                      Consistent Targets:,N/A

                      Inconsistent Targets:,Audit alerter (bbsa813)

                      Failed servers:,N/A

                      Show Compliant Audit Item(s):,Yes


                      Server Object,Stat,Item,Target,ACL Path,Consistent,Details

                      "Service","Alerter","Alerter","Audit alerter (bbsa813)","","Changed","Start Type (M: DISABLED,MANUAL)State (M: STOPPED,RUNNING)"



                      And here is the automatic script:

                      Simple Audit Export Version 1.0

                      Mapping: bbsa813 -> Device_1

                      Mapping: Alerter -> Template_Part_1

                      Export Results Table:

                      "Master Device","Target Device","Type","Qualified Path","Item Status","Size (master)","Size (target)","Checksum (master)","Checksum (target)"




                      Thanks again, it really helps a lot




                      • 8. Re: audit a service
                        Bill Robinson

                        w/ the blcli there is an option to include 'additional columns' - you would need to pass the columns you want to the blcli command.

                        • 9. audit a service
                          Erez Frenkel

                          Hi Bill,



                          I would like to get the same result like what we do by the manual export….



                          Can you please give example how to run that command?







                          • 10. Re: audit a service
                            Erez Frenkel

                            Hi Bill,


                            Can you please show example how to pass the columns to the blcli command?


                            We need the Inconsistent Targets, Service name, Service status




                            • 11. Re: audit a service
                              Bill Robinson

                              i don't know offhand what the column names are for what you want - the example in the blcli help shows like 'Size,Checksum' for file attributes so i'm assuming service status would be something similar to what is in the gui label ?