Client Management Suite

This document is for the purpose of introducing changes made with the release of Inventory Solution 7.0 SP2. It also includes additional troubleshooting tips provided by Engineering to assist in issues seen in the past by customers as reported to Support. Many issues have been addressed, and with a new resource throttling mechanism the impact the Inventory Agent causes on target systems can be greatly reduced.

Introduction

The following areas are covered in this document. This includes explanations of features/functions and in some cases makes a comparison between Inventory Solution 6.x and 7.0.

• Major Changes from Inventory Solution SP1 to SP2
• Computer Summary and Hierarchy
• Inventory Controls Versus Core Controls
• Verbose Logging
• Basic Inventory and Inventory Solution
• Delta Software Inventory
• Gathering Inventory Data
• Inventory Server Maintenance Tasks
• Report Debugging
• Start and Stop Events with Application Metering

Major Changes from SP1 to SP2

Platform Support:

• Inventory Solution :
  • Windows 7 (32-bit, 64-bit)
  • Windows Vista SP2
• Inventory Pack for Servers:
  • Windows 2008 Core (32-bit, 64-bit)/Core SP1 (32-bit, 64-bit)/Core R2 (64-bit)
    NOTE: Auditplus does not support delta file inventory on Core, it always returns full file inventory.
  • Windows 2008 SP2 (32-bit, 64-bit)/R2 (32-bit, 64-bit)
• Microsoft Internet Explorer 8 in Compatibility Mode

Auditplus throttling:

1. How did the file scan throttling work in 7.0 SP1?
   • User Interface:
     

     

   • The focus in SP1 for throttling was only controlled by manipulating hard drive activities. This approach was not effective in throttling CPU.
   • The wording in the user interface was not consistent with what occurred behind the scenes, and the results were not predicable. Often the results varied from computer to computer.
   • Internal algorithm to calculate disk usage was too complex to give a satisfactory explanation.
2. What changes have been made for 7.0 SP2?
   • User Interface change:
     

     

     Default setting is Normal.
     NOTE: This UI is applicable only to task/policy but not to stand-alone inventory.

   • Target Mapping of the System resource usage:
     

     	Linux	UNIX	Mac
     Very Low	19	39	20
     Low	10	30	10
     Normal	0	20	0
     High	-10	10	-10
     Very High	-20	0	-20

     Note: For Windows the target values are not published due to the restrictions of controlling the CPU sage. Instead, Audit Plus will use the subsequent methods in conjunction with the setting to throttle total resource usage, included CPU.

   • We attempt to directly control the CPU by observing the CPU usage for the Auditplus process. Then we observe run time computing how much time we should pause the Auditplus processing to keep the resource usage in limit.
   • Pausing in between also positively impacts disk utilization, thus laptop cases where the processor h/w is good but disk IO is poor, we don't slow down disk access.
   • The new implementation is more predictable and consistent across a range of different computers.
   • Note that spikes during the execution time will occur where the resource usage would cross the limits, but the process will try to bring the usage in the limits as soon as possible by continually observing the usage. This limits the amount of time a spike may occur as the Inventory process will adjust as necessary.
   • Note the following Limitations:
     • For EXE files, not including any data files, a hash must be computed as part of the Software Management model. This is a resource expensive process as the Software Management Framework utility is called to generate the hash. As Auditpls is calling this, the resource utilization will fall under this process. While smaller EXEs are generally not a problem, files that are 100+MB can have a marked resource impact that is not controlled by the Inventory throttling process. The Software Management team is reviewing their process to introduce efficiencies to this process, but this will not be included in the SP4 platform, SP2 solution release.
     • Dual core: On dual core machines, under certain unknown environment variables, the audit file scan may not adhere to the resource usage limits for all resource limitation rules, though other rule types appear to work sufficiently to minimize this impact.
   • Significant performance improvements to Audit file scan - As previously covered, SP1 computed the file hash, and this is a very expensive operation. It scanned:
     • Twice for each file, whereas computing it only once was sufficient.
     • For each of the EXE files as well as the data files , whereas computing only for the EXE files was required. (data files refers to the file types where "Report disk usage and count" is checked.

     Now the audit file scan only scans an EXE file once, and does not scan data files that are not of an application type.

   • Visual Studio excessive folders: The Audit scan takes significant time to scan thousands of folders, many of them empty. If the audit scan takes a long time and Visual Studio exists on the system, it is suggested to exclude any empty folder structure and only include those folders within Visual Studio that contains EXE files or other files you have configured to capture.
3. In the rare case that the previous throttling method is preferred (not recommended), it is possible to switch back to the old method, detailed here:
   Create a string entry, SetDiskIOThrottleTo, at registry path SOFTWARE\Altiris\Altiris Agent\Inventory Throttle Settings, set to one of the values - 10, 25, 50, or75.
   10 refers to Low settings in *SP1* and so on.
4. How do I configure the System resource usage for Stand-alone inventory package?
   Create a string entry, OverrideStandAloneCPUThrottle, at registry path SOFTWARE\Altiris\Altiris Agent\Inventory Throttle Settings, set to one of the values - 10, 20, 30, 40, or 99.
   10 refers to the Very Low in *SP2* and so on.

Throttle inventory reporting:

This option has been renamed. In 7.0/SP1, it was known as "Distribute sending inventory evenly over x hours. This is highly recommended if Inventory makes a significant impact on network bandwidth and/or Notification Server resources. By pushing this out to, say, 24 hours, at the scheduled time for Inventory all systems will execute it, but will wait a random amount of time, between now and 24 hours, to send in the collected Inventory. This gives the network or Notification Server time to process Inventory over time instead of being inundated all around the same time.

Provision for configuring a specific file type to scan for:

In 7.0 SP1 we had to use the following method:

• Complaints: The UI gave the wrong impression that users could simply type in the value for the File Type and those files would be collected during the scan. However those file types would not be captured.
• Reality: As the UI was unable to properly save the expected usage details for the scan, a process was developed that had to be followed in order to capture all files of a specific file type. The following KB article covers this process:
  https://kb.altiris.com/article.asp?article=49669&p=1

In Inventory Solution 7.0 SP2 this problem has been addressed.

• Now the functionality executes as expected if you add a file extension as shown below. Note that the * asterisk should be used to denote a wildcard for the filename.
  

  

Summary Pages:

• In Inventory 6.x the data interface in Resource Manager for a computer was fairly straight forward as the tables and column names were intuitive. For 7.x Inventory uses the CIM (Common Information Model) standard. While this allows all platforms such as Mac, Unix, Windows, etc to use the same data classes and tables, it no longer provides an intuitive view. In light of this, and with feedback from the user base, Summary pages were created to address the need to look at inventory per a system's Resource Manager.
  • Data is now consolidated in the Summary pages, instead of being scattered throughout the CIM structure.
  • Users can now see common Inventory in a summary view.
• The summary views are on a per computer basis.
• To reach these new pages, click on a computer resource > Resource Manager > Summary > and click Software Summary OR Hardware Summary.
• Software Summary Page:
  

  

  • A Software component is Virtualized if any of the file associated with it has virtualized GUID
  • A Software component shows metered data if any of files associated with it are metered and has entries in "Monthly Summary" data class, part of Application Metering.
  • A Software component shows as Denied if either the software is blacklisted or any of the files associated with it has a status of denied.
  • If the Software Management Discovery (run as part of Inventory) fails to report the Product Name and Manufacturer we use the Product Name and Manufacturer from the Windows File table.
• Hardware Summary Page:
  

  

  

  The Users and Groups view provides the following basic information:
  1.     Guid
  2.     Users
  3.     Group
  4.     Primary User

  Note the following known issue when viewing the Hardware Summary page discovered late in the process:

  

Windows 7 readiness reports:

• Reports are provided as part of Inventory Solution 7.0 SP2 that can assist in evaluating what systems meet the requirements for an upgrade to Windows 7. Conversely, the reports can also list systems that do not meet the requirements. See what thresholds are met or not met by reviewing the details provided in the report results.
• The reports can be cloned and edited should you wish to adjust the requirement thresholds.
• The hardware requirements for a computer to be Windows 7 upgrade capable are:
  • If Using XP Virtual Mode=No
    • For Win 7 32-bit: CPU >= 1 GHz, RAM >= 1GB, Free Space >= 16GB
    • For Win 7 64-bit: CPU >= 1 GHz, RAM >= 2GB, Free Space >= 20GB
  • If Using XP Virtual Mode=Yes, then additional 15GB free space should be available, so the requirements become:
    • For Win 7 32-bit: CPU >= 1 GHz, RAM >= 1GB, Free Space >= 31GB.
    • For Win 7 64-bit: CPU >= 1 GHz, RAM >= 2GB, Free Space >= 35GB.
• Another recommended check that is currently under consideration, but not implement, is if the CPU Virtualization Feature (AMD-VTM or Intel® VT) is enabled or not.
• To access this report, browse in the Symantec Management Console > Reports > All Reports > Discovery and Inventory > Inventory > Windows > Upgrade Analysis > Windows Upgrade
  

  

  
  

  

• Keep in mind that the above results don't call out what item caused the system to fail to meet Windows 7 requirements. The report results should be analyzed to discover what this is. One method is to copy the grid into an Excel or other spreadsheet and use the sort/filter details to discover what thresholds are not met.

Mac OS X 10.6 readiness reports:

• Reports are provided as part of Inventory Solution 7.0 SP2 that can assist in evaluating what Mac systems meet the requirements for an upgrade to Mac OS X 10.6 Snow Leopard. Conversely, the reports can also list systems that do not meet the requirements. See what thresholds are met or not met by reviewing the details provided in the report results.
• To access this report, browse in the Symantec Management Console > Reports > All Reports > Discovery and Inventory > Inventory > Mac > Upgrade Analysis
• The hardware requirements for a computer to be Windows 7 upgrade capable are:
  • CPU has to be Intel, RAM >= 1GB and Free Space >= 5GB

    

    

Asset tag information added

• In Inventory Solution 6.x, Inventory reported the Asset Tag in the AeX HW Serial Number data class, represented in the AssetTag column. WMI was used to fetch the data using the call Win32_SystemEnclosure WMI class > SMBIOSAssetTag field.
• Inventory Solution 7.0 - 7.0 SP1 did not report this data as part of Inventory. This was considered a regression of functionality.
• In Inventory Solution 7.0 SP2 this data is now reintroduced.
  • The data resides in the data class HW Chassis > in the Asset Tag which provides the same data as in 6.x. Schema details: c8, nvarchar(256), key=no, nullable=true.
  • Also the "Count of form factors" drill down was modified to show the Asset tag instead of the Identification Code in the Serial Number column of the drill down.

Processor Identification - KB#49210

• In Inventory Solution 7.0 - 7.0 SP1 the Processor Identification logic was sketchy at best. This resulted in depending on the WMI class Win32_Processor data class, Family value. Often this data in WMI would return as Unknown. This caused many processors to show up as Unknown for the type/model etc. In KB 49210 early on an alternate method was devised to capture the Processor information. Using this method, we found the success rate improved dramatically. As a result, the method in the KB is now integrated into Inventory 7.0 SP2.
• To integrate this, we introduced the hidden data class HW Processor Name Windows to store the processor name. This is fetched from Win32_Processor > Name field.
• Also a view was Introduced to merge information from HW Processor and HW Processor Name Windows. If the HW Processor reports Unknown, the view picks up the value form HW Processor Name, thus combining the two methods.
• The resource manager and reports refer to the view, thus users do not have to worry about the two source data classes.

Hierarchy and Replication changes/fixes in SP2

Computer summary and Hierarchy

The Computer Summary report does not show computers from any child Notification Servers in a hierarchy or replication environment. This holds true for Inventory Solution 7.0 SP2.

• All Inventory data classes are not, by default, replicated from the Child Notification Server to the Parent.
• The computer summary report internally uses two summary data tables, namely, Inv_Hardware_Summary and Inv_Operating_System_Summary. These tables are populated on the child NS when the NS daily schedule task runs which runs the SP's internally, but are not replicated to the Parent.
• Thus by default the inventory for computers from the child NS do not reach the Parent and the report does not show computers from Child NS.
• Work around: Enable the replication rules to replicate the hardware and operating system data classes to the Parent NS. Next, run the NS daily on the parent NS to have the Summary tables populated. The report now will be fully populated.

Inventory controls Vs Platform provided controls

This section covers what controls are used where, helping to understand where issues may occur. This can be important when reporting issues or feedback for controls to the proper Product team.

1. Grid scroll bar - One known issue that was a bother shows up in the advanced options of Inventory task or policy. Browse under "File properties scan settings" tab. There are grids for including/excluding folders, specifying file rules, etc. For a number of records in SP1 and previous versions the scroll bar did not show up. The grid control is provided by platform and Inventory solution leverages the controls. The scroll bar absence gives the impression that few records only are present. This has been fixed by platform and you will now be able to see the scroll bar in SP2 of Inventory Solution, SP4 of the Platform.

   

   Fig: Scroll bar in grid control

2. Resource target builder control - In SP1 and SP2 the filters of Inventory solution are ReadOnly (NoModify + NoDelete attributes). On the Inventory policy page, you can see the filters but since they are ReadOnly, the "Add Rule" and "OK" button are enabled as seen below. Internally the control respects the "ReadOnly" behavior and does not allow changes made by a user to be saved. In other words it shows as editable, however any edits are not actually saved due to the "ReadOnly" attribute.

   

   Fig: Inventory policy page - resource target builder control for targets

   NOTE! that new filters can be added, and the default filter can be removed, but just not edited directly. Now the similar control behaves differently on inventory plug-in page. As shown below "Add Rule" and "OK" button are disabled, as they should be.

   

   Fig: Inventory plug-in policy page - resource target builder control for targets

Verbose logging

Verbose logging is a valuable troubleshooting tool. In Inventory 6.x Verbose Logging could only be enabled by installing a debugger, such as Debug View (dbgview.exe) provided by Microsoft SysInternals. In 7 verbose logging is now accomplished through the standard Symantec Management Agent logging system.

• To enable Verbose Logging per Task or Policy, go into the Advanced Settings and click on the Run Options tab. Check the box labeled Enable verbose client logging (see the below screenshot):

  

• To enable verbose logging for a Standalone package, use the following command-line as demonstrated:
  

  StandalonePackageName.exe /EnableVerboseLog
  

• Verbose logging uses the existing Altiris Agent logging framework, thus verbose logging through be enabled on the client to receive the full trace logging.
• Selecting the option internally sets the DWORD entry, Severity at HKML\Software\Altiris\Altiris Agent\Event Logging\LogFile to 255 decimals on the clients to turn ON all the logging level of Altiris Agent logging framework.
• The framework keeps polling the registry entry after certain interval, so the effective logging starts delayed.
• To avoid delay, manually (or thru Run script task) set the registry flag and either restart Altiris Agent or let it run for some time, before rolling out the task.
• How to avoid the log being over-written?
  • By default log could go up 20 files, for example: Agent.log (always the recent most), Agent1.log, Agent2.log, …, Agent19.log and each of the file could max grow up to 101KB.
  • After this limit is exhausted, it starts overwriting from the first file.
  • You can increase the limits, as demonstrated in this screenshot:

    

Basic Inventory and Inventory Solution

In Inventory Solution 6.x Basic Inventory was included in the Machine Inventory process (AeXMachInv.exe). This was to allow a Full inventory to trigger a Resource Creation if a system did not exist when full Inventory was sent.

• Inventory Solution 6.x
  • Sends Basic Inventory when running any Inventory Task on managed computers and also when a stand-alone package runs on any system, whether managed or agentless.
  • The basic inventory data classes and Inventory Solution data classes would be included in the same NSE, thus potentially overwriting what the Altiris Agent provided.
• Inventory Solution 7.0
  • Sends Basic Inventory only when running as a stand-alone inventory package.
  • The basic inventory is stored in a separate NSE than the Inventory Solution data classes.
  • AeX AC Client Agent is intentionally skipped when reporting the basic inventory, because if NS sees this data class being reported, it marks the computer as IsManaged=1 (giving the NS the idea that the agent is managed by an Agent).
  • The basic inventory data classes that are fetched using AeXBasicInventory.dll
    • AeX AC Location
    • AeX AC Identification
    • AeX AC Roles
    • AeX AC NT Services
    • AeX AC TCPIP
    • AeX AC TCPIPv6

Delta Software Inventory

How do we calculate Software Inventory during a Delta scan? The first time Software data is sent to the Notification Server, all data will be sent. How will this data be treated at a delta level when running the Delta Inventory Policies or Tasks?

1. Whenever we do a software scan, AeXAuditPls.exe persists the scanned data for future comparison in a file named InvData.mdb in the Altiris Agent\Agents\Inventory Agent folder.
2. This file is an MS Access file which contains the table InvData which auditpls populates to store the scan file information.
3. The fields of this table are ScanGuid, FileHash, Size, FilePath, Flag and id.
4. During the second (and following) detailed file scans, we first scan for all the files (.exes) and compare the scanned data with the previous scan data in the InvData table in the InvData.mdb database.
5. For all matching file entries in the InvData table, we don't resend the same data again to the NS essentially saving network bandwidth and NS processing.
6. After sending the difference to the NS, we replace the old InvData.mdb with the new one, with new scan data. This new database will then be used during the next Delta Software scan.
7. So to summarize the process, for the New scan, we compare with the Old scan data. We send the differences between the two and replace the Old InvData.mdb with the New InvData.mdb.
8. Following is a screenshot of InvData.mdb opened up in MS Access.

   

9. ScanGuid: This is a task Guid which's unique for every software inventory task that rolls out.
10. FileHash: This is a number we get after passing the entire file through the MD5 hashing algorithm. It generates a fixed length unique (seemingly) random number called as a hash for a digital input of any length, in this case a file. The hash generated would look random but it's ensured that the same input would always yield the same hash. Also, the probability of the hashes of two different inputs generated being same is extremely low.
11. The time required in generating the filehash is in direct proportion to its size. This could be an extremely expensive proposition especially when done in a loop for very large number of files, as we saw previously. Thus we have optimized our software scan by eliminating filehash generation in one of the places in the file scan loop.
12. Even on the NS the quickest way to identify or compare a file is by its FileHash and size i.e. (FileHash.Size)
13. Size: This is the size of the file in bytes.
14. File Path: This is the local file path of the file.
15. id: This is sequentially generated number acting like a primary key and a row number.
16. All the data Inventory gathers for Hardware, OS and User group scan is placed in the NSIs in the local inventory folder. The NSIs generated are then combined into a single NSE and sent to NS. The final NSEs can be found in the Outbox folder. Namely the Auditpls_diskusage, Auditpls_filescan, Auditpls_summary, client inventory file prefixed CLN (e.g. CLNINV6E), server inventory file prefixed SRV (e.g. SRVINV6E)
17. The generated NSIs are then backed up with the extension .bak for future comparisons. During the next inventory task (Hardware, OS or User group), the scanned data is compared with the .bak files and only delta is sent to the NS.
18. For the software discovery we make use of the SMFAgent. So, data generated by software discovery is posted directly to NS. There is separate delta logic for this, not covered by Inventory Solution.

How do we fetch the Inventory data?

Often the question arises how we capture specific points of data. While this is known to us, this information is considered proprietary and this data will not be generally given out. However to provide some insight into the processes, note the following details:

• WMI is the primary source of data. Most data is captured from the \Root\cimv2 WMI structure.
• File scan - Our audit process will scan every file on system (except those contained in areas excluded from the scan). The process involved includes taking the file and opening the Header information. The Properties of the file are also captured as part of the examination of the file.
• Registry - The Windows Registry is a source of data commonly used by Inventory Solution. Most of the data resides in the HKEY_LOCAL_MACHINE registry hive.
• Other programmatic methods - Other processes contained within the Inventory Solution Plug-in may be applied throughout the process. These functions are compiled as part of the Plug-in.

The following are a few examples to illustrate how data is captured by the WMI and Registry methods.
Examples:

1. WMI - For gathering data about Printers, we use the following WMI class and values:
   1. Driver Version field from root\cimv2 > Win32_Printer > Name
   2. Driver Provider field from root\cimv2 > Win32_Printer > DriverName
   3. Device ID field from root\cimv2 > Win32_Printer > DeviceID
2. Registry - For specific Device Driver information, see the following examples:
   1. For Pointing devices using code to manipulate the registry keys as follows:
      • i. The GUID for Pointing Device is hardcoded which is {4D36E96F-E325-11CE-BFC1-08002BE10318}.
      • ii. Each system will return a registry path for the Guid, usually at HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96F-E325-11CE-BFC1-08002BE10318}
   2. To capture Video controller information we use similar code.
      • i. The GUID for Pointing Device is hardcoded which is {4D36E968-E325-11CE-BFC1-08002BE10318}
      • ii. One example of the registry path returned by a system is shown as : KEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}
   3. To capture SCSI controller data, the code is again similar to the previous examples.
      • i. The GUID for Pointing Device is hardcoded which is {4D36E97B-E325-11CE-BFC1-08002BE10318}
      • ii. One example of the registry path returned by a system is shown as : HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}

NS daily dependent or obscure schedules

There are a few items that run in the background on the Server, populating data or doing other server-based calculations or procedures.

Here is a list of Stored Procedures and their primary function:

1. Sp_HardwareSummary - This SP populates the Summary tables used by certain controls and reports.
2. Sp_OperatingSystemSummary - This SP also populates Summary tables used by certain controls and reports.
3. Sp_Inv_InventoryCleanUp - When a machines is retired on the NS, The Inventory clean-up process will take the Inventory data for any retired system and purge it from the Database. The purpose of this is to free up the license node used by that now retired system.

All three Stored Procedures above run when the NS Daily task executes. To look at this task, browse on the Notification Server in the Control Panel > Scheduled Tasks. Look for the NS.Daily task in the list.

Debugging Inventory Reports

Normally reports are debugged using the SQL that the report executes. This requires SQL knowledge, which is not covered here. To assist in this process, the following details about the report are available if you export or view the report in XML format. These options are available when you right-click on the report in the left-hand tree view.

Please find XML structure of "Count of Computers with/without Anti-virus Software" report along with explanation about XML tags below.

 
<item guid="{21086963-E60D-4386-8343-B1C6C9D2BE2E}" classGuid="{A968A2A6-C9B9-483B-B9E0-7F0B199F9DA3}">  --Beginning of Report Management Item--
  <name>Count of Computers with/without Anti-virus Software</name>
  <description>This report lists installed anti-virus software by product and version. A drill down on each product/version line in the report lists the computers with that product and version.</description>
  <itemAttributes>NoReplication, Readonly</itemAttributes>
  <itemLocalizations>
   <culture name="">
    <name>Count of Computers with/without Anti-virus Software</name>
    <description>This report lists installed anti-virus software by product and version. A drill down on each product/version line in the report lists the computers with that product and version.</description>
   </culture>
  </itemLocalizations>
  <reportLocalization>
   <culture name="">
    <parameter>Filter</parameter>
    <parameter>Domain:</parameter>
    <parameter>Computer Name:</parameter>
    <drilldown>View Antivirus Computers</drilldown>
    <column>Number of Computers</column>
    <column>Product Name</column>
    <column>Product Version</column>
   </culture>
  </reportLocalization> -- Localization of parameters and columns of report.--
  <report>
   <implementation classGuid="{7F99312F-5A60-4836-A3F7-9B97B3A43D7A}">
                 <configuration isScoped="True" isSnapshotMode="False">
     <contextMenus>
      <contextMenu key="ItemMenu">
       <implementation classType="Altiris.Reporting.UI.ContextMenu.ItemMenuFactory">
        <configuration>
         <itemGuidField>Guid</itemGuidField>
        </configuration>
       </implementation>
      </contextMenu>
      <contextMenu key="LinkMenu">
       <implementation classType="Altiris.Reporting.UI.ContextMenu.LinkActionMenuProvider">
        <configuration>
        </configuration>
       </implementation>
      </contextMenu>
     </contextMenus>
     <dataPresentations>
      <dataPresentation>
       <implementation classGuid="{5701F69D-820E-4DA4-A047-91B32FDF9A3C}">
        <configuration>
         <base>
          <id><![CDATA[MyGridView]]></id>
         </base>
        </configuration>
       </implementation>
      </dataPresentation>
     </dataPresentations>
     <parameters> -- Beginning of parameters definitions--
      <layouts>
       <layout id="ParameterLayout">
        <table>
         <row>
          <cell literal="true" controlName="Filter">
          </cell>
         </row>
         <row>
          <cell controlName="Domain">
          </cell>
         </row>
         <row>
          <cell controlName="Computer Name">
          </cell>
         </row>
        </table>
       </layout>
      </layouts> -- Layout of parameters on UI--
      <parameter>
       <name>Filter</name>
       <description>Filter</description>
       <required>false</required>
       <nullable>true</nullable>
       <parameterTypeGuid>40d6ba82-776b-4d89-b1a8-8322b6ca64f5</parameterTypeGuid>
       <defaultValue>2c1b4a56-4bc6-4e03-8589-fb53499b7e55</defaultValue>
       <valueProvider classGuid="{FD8B9293-29B1-42E2-BAC5-7774DF8143CC}">
        <configuration readonly="False" hideOnError="False">
         <style labelVisible="True" linkInSummary="False" showNoControls="False" allowMultiSelect="False" />
        </configuration>
       </valueProvider>
       <requiredParameters />
      </parameter>
      <parameter>
       <name>Domain</name>
       <description>Domain:</description>
       <required>true</required>
       <nullable>false</nullable>
       <parameterType>ptype-string</parameterType>
       <defaultValue>%</defaultValue>
       <valueProvider classType="Altiris.Reporting.Parameters.ParameterValueEditControls.DatasourceDropdownListPVEControl">
        <configuration>
         <style controlWidth="" labelVisible="True" labelText="Domain:" />
         <values>
          <value name="--Any--">%</value>
          <dataSource guid="{AD779F6F-0365-422F-AAF1-1E34A33D0010}" textField="Domain" valueField="Name">  -- DataSource Management Item of "Domain" parameter. Since there is no "Embed" attribute mentioned in it therefore by default value of it would be "False" i.e. definition of this DataSource Management Item would be defined in another file.--
          </dataSource>
         </values>
        </configuration>
       </valueProvider>
      </parameter> -- Definition of parameter populated through SQL query.--
      <parameter>
       <name>Computer Name</name>
       <description>Computer Name:</description>
       <required>true</required>
       <nullable>false</nullable>
       <parameterType>ptype-string</parameterType>
       <defaultValue>%</defaultValue>
       <valueProvider classType="Altiris.Reporting.Parameters.ParameterValueEditControls.BasicParameterValueEditControl">
        <configuration>
         <style multiline="False" multilinerows="2" labelVisible="True" labelText="Computer Name:" />
        </configuration>
       </valueProvider>
      </parameter> -- Definition of Simple parameter--
     </parameters> -- End of parameters definition--
     <dataSource guid="{170184E9-9EB1-47AD-8080-25FA368B826C}" embed="true">
      <item guid="{170184E9-9EB1-47AD-8080-25FA368B826C}" classGuid="{AA232A71-E633-4F4A-A48F-BCCCC7535269}">
       <name>Count of Computers with/without Anti-virus Software</name>
       <description>This report lists installed anti-virus software by product and version. A drill down on each product/version line in the report lists the computers with that product and version.</description>
       <itemAttributes>Hidden,NoReplication, Readonly</itemAttributes>
       <dataSource>
        <implementation classType="Altiris.Reporting.DataSource.RawSqlDataSource">
         <configuration>
          <base>
                                                <scope>
                                                        <scopingFields>
                                                                <scopingField>Guid</scopingField>
                                                        </scopingFields>
                                                </scope>
                                                <parameters>
                                                        <parameter>
                                                                <name>TrusteeScope</name>
                                                                <description>Scoping Parameter</description>
                                                                <required>true</required>
                                                                <nullable>false</nullable>
                                                                <parameterType>PType-ScopeTrusteeList</parameterType>
                                                                <testValue>S-1-1-0,S-1-5-21-584045613-2877177974-2588806179-1006,S-1-5-21-584045613-2877177974-2588806179-1018</testValue>
                                                                <order>10</order>
                                                                <valueProvider classType="Altiris.Reporting.Parameters.ParameterValueProviders.CurrentIDMembershipValueProvider">
                                                                        <configuration />
                                                                </valueProvider>
                                                                <requiredParameters />
                                                                <configurationControlClassGuid>73bded50-f1aa-4ff4-a80e-a6c9e047d472</configurationControlClassGuid>
                                                        </parameter>
                                                        <parameter>
                                                                <name>_culture</name>
                                                                <description>Localization Key Parameter</description>
                                                                <required>false</required>
                                                                <nullable>false</nullable>
                                                                <parameterType>PType-String</parameterType>
                                                                <testValue>EN</testValue>
                                                                <defaultValue>EN</defaultValue>
                                                                <valueProvider classType="Altiris.Reporting.Parameters.ParameterValueProviders.ReportAttribValueProvider">
                                                                        <configuration>
                                                                                <reportProperty>
                                                                                        <![CDATA[ Properties.Culture ]]>
                                                                                </reportProperty>
                                                                        </configuration>
                                                                </valueProvider>
                                                                <requiredParameters />
                                                                <configurationControlClassGuid>73bded50-f1aa-4ff4-a80e-a6c9e047d472</configurationControlClassGuid>
                                                        </parameter>
            <parameter>
             <name>Filter</name>
             <parameterTypeGuid>40d6ba82-776b-4d89-b1a8-8322b6ca64f5</parameterTypeGuid>
             <defaultValue>2c1b4a56-4bc6-4e03-8589-fb53499b7e55</defaultValue>
            </parameter>
            <parameter>
             <name>Domain</name>
             <parameterType>ptype-string</parameterType>
             <defaultValue>%</defaultValue> -- Default values of "Domain" parameter.--
            </parameter>
            <parameter>
             <name>Computer Name</name>
             <parameterType>ptype-string</parameterType>
             <defaultValue>%</defaultValue>
            </parameter>
           </parameters>
          </base>
          <query>
        <![CDATA[
DECLARE @v1_TrusteeScope nvarchar(max)
SET @v1_TrusteeScope = N'%TrusteeScope%'
SELECT COUNT(DISTINCT CAST(i.[Guid] as varchar(40))) [Number of Computers],  
        a1.[Name] [Product Name],      
        --mkd.[KnownAs] [Manufacturer],
        a1.Version [Product Version]  
FROM dbo.vComputer i 
JOIN dbo.ScopeMembership sm
        ON sm.[ResourceGuid] = i.Guid
        AND sm.[ScopeCollectionGuid] IN (SELECT * FROM dbo.fnGetTrusteeScopeCollections (@v1_TrusteeScope)) 
JOIN dbo.vSWAntivirusWindows a1  
        ON a1.[_ResourceGuid] = i.Guid  
--JOIN dbo.ManufacturerKnownAsDefault mkd
        --ON a1.[Name] LIKE mkd.[KnownAs] + '%'
JOIN dbo.CollectionMembership cm 
        ON cm.ResourceGuid = i.[Guid] 
JOIN dbo.vCollection it 
        ON it.Guid = cm.CollectionGuid 
WHERE 1 = 1 
AND i.[System Type] LIKE 'Win%' 
AND LOWER (i.[Name]) LIKE LOWER ('%Computer Name%') 
AND i.Domain LIKE '%Domain%' 
AND LOWER (it.[Guid]) LIKE LOWER ('%Filter%') 
GROUP BY 
        a1.[Name], 
        --mkd.[KnownAs], 
        a1.Version 
                         
UNION ALL 
                 
SELECT COUNT(DISTINCT CAST(i.[Guid] as varchar(40))) [Number of Computers],  
        ISNULL (dbo.fnLocalizeString ('No Virus Protection','21086963-e60d-4386-8343-b1c6c9d2be2e','%_culture%'), 
dbo.fnLocalizeString ('No Virus Protection','21086963-e60d-4386-8343-b1c6c9d2be2e','en')) [Product Name], 
        --NULL [Manufacturer],  
        NULL [Product Version]  
FROM dbo.vComputer i 
JOIN dbo.ScopeMembership sm
        ON sm.[ResourceGuid] = i.Guid
        AND sm.[ScopeCollectionGuid] IN (SELECT * FROM dbo.fnGetTrusteeScopeCollections (@v1_TrusteeScope)) 
JOIN dbo.CollectionMembership cm 
        ON cm.ResourceGuid = i.[Guid] 
JOIN dbo.vCollection it 
        ON it.Guid = cm.CollectionGuid 
WHERE 1 = 1 
AND i.Guid NOT IN 
( 
        SELECT a1._ResourceGuid 
        FROM dbo.vSWAntivirusWindows a1  
)       
AND i.[System Type] LIKE 'Win%' 
AND LOWER (i.[Name]) LIKE LOWER ('%Computer Name%') 
AND i.Domain LIKE '%Domain%' 
AND LOWER (it.[Guid]) LIKE LOWER ('%Filter%')        
HAVING COUNT(DISTINCT CAST(i.[Guid] as varchar(40))) > 0
ORDER BY 
        COUNT(DISTINCT CAST(i.[Guid] as varchar(40))) DESC -- Query of report.--
                                        ]]></query>
         </configuration>
        </implementation>
       </dataSource>
       <parentFolderGuid>8f8731c4-8eac-4d9c-a166-bd4999feba50</parentFolderGuid>
      </item>
     </dataSource>
    </configuration>
   </implementation>
   <viewingControl>
    <implementation classGuid="{A967DB13-CD5F-4246-8FC1-29959EE5046F}">
     <configuration>
      <base>
       <id><![CDATA[MyReportView]]></id>
       <linking>
                                 <links>
                                         <link id="View_Antivirus_Computers" sourceId="MyGridView" targetId="MyReportView" event="ContextMenu" name="View Antivirus Computers">
                                                 <action id="Drilldown">
                                                         <arguments>
                                                                 <argument name="MoveToReport"><![CDATA[02c50a7b-dd81-49bd-befc-94602fbb887f]]></argument> -- Guid of report to which current will drill down to--
                                                         </arguments>
                                                 </action>
                                                 <parameterMappings>
                                                         <map sourceParameter="SelectedRow[Product Name]" destinationParameter="Product Name" /> -- Values to be passed to Drill down report--
                                                         <map sourceParameter="SelectedRow[Product Version]" destinationParameter="Product Version" /> -- Values to be passed to Drill down report--
                                                 </parameterMappings>
                                         </link>
                                         <link id="ShowContextMenu" sourceId="MyGridView" targetId="MyReportView" event="ContextMenu" visible="false">
                                                 <action id="ContextMenu">
                                                         <arguments>
                                                                 <argument name="MenuFactories" list="true">
                                                                         <value>LinkMenu</value>
                                                                 </argument>
                                                         </arguments>
                                                 </action>
                                                 <parameterMappings>
                                                         <map sourceParameter="SelectedRow" destinationParameter="ItemGuid" />
                                                 </parameterMappings>
                                         </link>
                                 </links>
       </linking>
      </base>
     </configuration>
    </implementation>
   </viewingControl>
  </report>
  <parentFolderGuid>8f8731c4-8eac-4d9c-a166-bd4999feba50</parentFolderGuid>
 </item> -- End of Report Management Item--

• The above XML explanation helps identify the parameter's queries versus the Report's query etc allowing the individual compartments to be independently scrutinized.
• For verification of report's result, copy the query of the report in SQL Server Management Studio on NS configured database. NOTE:
  • Replace parameter's values with their default values and execute it.
• To get the query of DataSource Management Item which is not embedded in the report's XML. Search DataSource guid shown in the file to find the item on the NS.
• While replacing the query of a report with a modified one, please make sure that all columns that are being passed to the drilldown report are present in the modified query, or drill down functionality will not work.

Debugging start/stop events and monthly summary for Application Metering

There are 4 DLLs related to application metering.

1. AMAgent.dll
2. AeXSystemPerformance.dll
3. AMInit32.dll
4. AMInit64.dll

1. AMAgent.dll:
   1. This is a plug-in to the Altiris agent.
   2. It's usually present at <Altiris agent installation directory>\Agents\Application Metering Agent\
   3. This is a COM DLL. I.e. needs to be registered using regsvr32 for it to come into effect. If you are replacing or need to reregister this DLL.
   4. This DLL is responsible for client side scheduling i.e. scheduling sending of metering events.
   5. It also matches applications with policies to determine which applications need to be metered and/or denied.
2. AeXSystemPerformance.dll:
   1. This DLL interacts with the AMAgent.dll.
   2. It's usually present in the system32 folder.
   3. This is a COM DLL. I.e. needs to be registered using regsvr32 for it to come into effect.
   4. It's responsible to keep the performance statistics of all applications for which we send in monthly summary for.
3. AMInit32.dll:
   1. This DLL interacts with the AMAgent.dll.
   2. It's usually present in the system32 folder on 32-bit OS and syswow64 on 64-bit machines.
   3. This is not a COM DLL so it does not require COM registration.
   4. To enable this file on 32-bit OS, one must make its entry in the following registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs also the key LoadAppInit_DLLs should be set to 1. On some OSs the LoadAppInit_DLLs might not be present or needed.
   5. To enable this file on 64-bit OS, one must make its entry in the following registry key HKEY_LOCAL_MACHINE\SOFTWARE\SYSWOW64\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs also the key LoadAppInit_DLLs should be set to 1. On some OSs the LoadAppInit_DLLs might not be present or needed.
   6. This DLL maps into almost every 32-bit exe that's launched after making the registry entry. It is responsible for sending the information about the process (like exe path, its PID etc) to the AMAgent.dll. AMAgent.dll then compares this information with its policies that it has received from NS. If the process shouldn't be running, AMAgent.dll sends a message back to the same AMInit32.dll and asks to terminate itself, eventually taking down the entire process.
   7. If the agent isn't started yet, this DLL writes the messages in the folder Temp\AeXAM. As soon as the agent starts up. It first scans this folder for the messages and makes events out of it for the time it was down.
4. AMInit64.dll:
   1. This DLL is same as the AMInit32.dll except it's used for 64-bit applications.
   2. It's present in the system32 folder and found only on 64-bit OS.
   3. To enable this file on 64-bit OS, one must make its entry in the following registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs also the key LoadAppInit_DLLs should be set to 1. On some OSs the LoadAppInit_DLLs might not be present or needed.
   4. This DLL maps into almost every 64-bit exe that's launched after making the registry entry.

How to capture events (or any NSE) sent form the client?

1. Open up the registry editor using regedit.exe
2. Locate the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\Altiris Agent\Transport
3. Locate the value Capture Events folder
4. Set it to a folder path where you want to capture events that are being sent from the client to NS.
5. To check quickly, make Altiris agent to send Basic Inventory. Notice that an NSE is captured as soon as you send the basic inventory in the Capture Events Folder that you just set.

How to quickly see if metering is sending events?

This manual modification will override the send events interval set on the NS for metering events.

1. Set the Capture Events Folder to capture the outgoing NSEs. (See How to capture events (or any NSE) sent form the client?)
2. Open up the registry editor using regedit.exe
3. Locate the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\Altiris Agent
4. In the key Altiris Agent Make a New > Key named AMAgent.
5. In the key AMAgent, make a DWORD value named Interval.
6. Set the value of Interval to a value 30(Decimal).
7. Restart the Altiris agent service once to enable this hack.
8. Try launching applications which would trigger sending events.
9. The events should get captured in under a minute in the Captured events folder that you've just set.

Some other points:

1. The metering agent is not supported on Server OSs like Windows 2003 or Windows 2008 etc. Please ensure the agent is not running on this server-based platforms.
2. If the metering agent is not rolling out to some machines, probably the machine's OS is server OS like Windows 2003 etc. Again, this is an unsupported environment and any server OSs need to be removed from the rollout filter.
3. There's some confusion about how sending monthly summary data works. To send monthly summary data we need to do two things:
   1. The Monthly Summary "global switch" aka "Send Summary Data" setting, needs to be explicitly turned on. This is not turned on by default at this point. WE will make this turned on out of the box in 7.1.

      

   2. At least one Metering Policy needs to be activated, such as All Applications which basically monitors all EXE, *.exe, or any other Metering Policies defined, one for each exe you want to track.

Conclusion

Hopefully this helps you understand the changes made between Inventory Solution 7.0 SP1 and 7.0 SP2, and that the troubleshooting information included in the second half assists when troubleshooting issues with this new release.