On occasion, it is necessary to troubleshoot Managed Software Delivery (MSD) detection rules. The following information may prove helpful to finding this information on both the NS and on a Unix, Linux and Mac (ULM) client computer.
For example, checking the contents of specific client-side files can verify that changes to the detection rule were received by the client during the latest policy refresh.
Note that the terms "Inventory rule" and "Detection rule" are synonymous.
SMP/NS Database Information Related to Detection/Inventory Rules
********************************************************************************
The symantec_cmdb database contains inventory rule data in the following tables:
The rule name is found in: RM_ResourceInventory_Rule
The rule criteria is found in: Inv_Inventory_Rule
These two, simple queries will return data from the above two tables.
Change the @ruleName and @ruleGuid values to search for your detection rules.
-- Search by name of the inventory rule
Declare @ruleName varchar(255)
Set @ruleName = '%opera%'
select rir.guid, rir.name, iir.inventoryrulexml
from rm_resourceinventory_rule rir
join inv_inventory_rule iir on iir._resourceguid = rir.guid
and name like @ruleName
-- search by guid of the inventory rule
Declare @ruleGuid varchar(255)
Set @ruleGuid = '%885AE568%'
select rir.guid, rir.name, iir.inventoryrulexml
from rm_resourceinventory_rule rir
join inv_inventory_rule iir on iir._resourceguid = rir.guid
and rir.guid like @ruleGuid
The RM_ResourceInventory_Rule table contains the following three guid columns. The guids returned in this example are defined by querying the followint tables, as shown here:
| Attribute |
Query to find description of the RM_ResourceInventory_Rule guid value |
Description of the guid value |
| ResourceTypeGuid |
select * from ResourceType where guid = '94A2BCC3-8F8B-499F-A135-378C00C9C533' |
This resource type is 'Inventory Rule'. |
| OwnerNSGuid |
select * from item where guid = '213C4D29-270A-45B0-BB2F-45D5816DE1BD' |
The owner guid is the guid of NS itself |
| ProductGuid |
select * from vproduct where guid = 'AD0DD85E-43CA-4AF4-A66C-DDDCAF8C2F57' |
The product guid is for 'Software Management Framework' |
ULM Client Files Related to Detection/Inventory Rules
********************************************************************************
A 'grep' of the partial inventory rule guid on a mac client, found five matching files.
The grep command used is in this case is: "grep -d recurse -i 885AE568 /opt/altiris". (Note that in this case, the inventory rule guid is: 885AE568-7D3A-4D2D-AC0A-5E48DFC51349 and a partial guid value was used in the search.)
The following to files contained the actual inventory rule(s) with the swcomponent and the rule criteria, i.e., "<swc name="com.operasoftware.Opera" version="12.88.88" status="LESS_OR_EQUAL" />":
- /opt/altiris/notification/iragent/var/ira/rules.xml
- /opt/altiris/notification/iragent/var/ira/DataClasses/{00000000-0000-0000-0000-000000000000}/InventoryRules/{885AE568-7D3A-4D2D-AC0A-5E48DFC51349}.xml
These three files simply contain a reference to the inventory rule guid along with other policy/task information:
- /opt/altiris/notification/smfagent/var/swc.dat: <RuleGuid>{885AE568-7D3A-4D2D-AC0A-5E48DFC51349}</RuleGuid>
- /opt/altiris/notification/nsagent/var/securedb.decrypted/ctagent/cache/E81404E1-8D3E-4BD0-AC8D-F0E651EFFC0F.tdf
- /opt/altiris/notification/nsagent/var/securedb.decrypted/nsagent/policies/data/AC14AFAF-0D2F-4E16-B571-91507A95C2DA/F30CE14CB43D789DD0E5296600F6531B7CFEF22430F2A98413B03AC4D4FC75DB