United Kingdom Endpoint Management User Group

 View Only

How to find out where a package was downloaded from? 

Jan 27, 2014 04:01 PM

This article includes the evolution of a report, by merging two queries together.

DISCLAIMER:  The machine names, IP Addresses and Domain names are ficticious lab values that no longer exist.

 

The following query utilises default SMP database objects, and provides a packages download method to a specific resource:

 

SELECT CASE

WHEN charindex('http://', [URL]) > 0 THEN 'HTTP'

WHEN charindex('https://', [URL]) > 0 THEN 'HTTPS'

WHEN charindex('\\', [URL]) > 0 THEN 'UNC'

WHEN charindex('Multicast', [URL]) > 0 THEN 'Multicast'

ELSE ''

END COLLATE DATABASE_DEFAULT AS PackageDownloadMethod,

p.PackageName,vc.Name AS Computer,vc.Domain,vc.[IP Address],vc.[User]

FROM Evt_AeX_SWD_Package p

JOIN vComputer vc ON vc.[Guid] = p._ResourceGuid

WHERE (LEN(URL) > 0) AND (EventType = 'End')

AND p.PackageName = 'Desktop Rover'

ORDER BY PackageDownloadMethod ASC

15.png

 

 

As you can see, the above query is missing one important piece of information, and that is where was the package downloaded from.  The following query is used by the vITAnalytics_CMDB_PackageDownloadSourceDim view to work out the download source.  The good thing about this view is that it does not need ITA to be configured, as it interrogates default SMP database objects:

 

SELECT DISTINCT PackageDownloadSourceName, PackageDownloadSourceType

                  FROM (SELECT    

                  CASE WHEN charindex('.', [Name]) > 0 THEN upper(substring([Name], 0, charindex('.', [Name]))) ELSE Name END COLLATE DATABASE_DEFAULT AS  PackageDownloadSourceName,

                  'Notification Server' COLLATE DATABASE_DEFAULT AS PackageDownloadSourceType

                  FROM [SQL-W2K8-01].[Symantec_CMDB_2].[dbo].[vNotificationServerSource] as vNotificationServerSource

                  UNION

                  SELECT DISTINCT vc.Name COLLATE DATABASE_DEFAULT AS  PackageDownloadSourceName, 'Package Server' COLLATE DATABASE_DEFAULT AS  PackageDownloadSourceType

                  FROM

                  [SQL-W2K8-01].[Symantec_CMDB_2].[dbo].[vComputer] AS vc INNER JOIN

                  [SQL-W2K8-01].[Symantec_CMDB_2].[dbo].[SWDPackageServer] ON vc.Guid = SWDPackageServer.PkgSvrId

                  UNION

                  SELECT     PackageDownloadSourceName COLLATE DATABASE_DEFAULT AS PackageDownloadSourceName

                  , 'Non-Altiris Server' COLLATE DATABASE_DEFAULT AS PackageDownloadSourceType

                  FROM         (SELECT DISTINCT

                                                                                    CASE WHEN charindex('//', [URL]) > 0 THEN upper(substring(substring([URL], charindex('//', [URL]) + 2, len([URL]) - charindex('//', [URL]) - 1), 0, charindex('/',

                                                                                    replace(substring([URL], charindex('//', [URL]) + 2, len([URL]) - charindex('//', [URL]) - 1), '.', '/')))) WHEN charindex('\\', [URL])

                                                                                    > 0 THEN upper(substring(substring([URL], charindex('\\', [URL]) + 2, len([URL]) - charindex('\\', [URL]) - 1), 0, charindex('\', replace(substring([URL],

                                                                                    charindex('\\', [URL]) + 2, len([URL]) - charindex('\\', [URL]) - 1), '.', '\')))) WHEN charindex('Multicast download complete. Master: ', [URL])

                                                                                    > 0 THEN upper(substring([URL], charindex('Multicast download complete. Master: ', [URL]) + 37, len([URL])

                                                                                    - charindex('Multicast download complete. Master: ', [URL]) - 36)) ELSE NULL END COLLATE DATABASE_DEFAULT AS PackageDownloadSourceName,

                                                                                    'Non-Altiris Server'COLLATE DATABASE_DEFAULT AS PackageDownloadSourceType

                                                  FROM [SQL-W2K8-01].[Symantec_CMDB_2].[dbo].[Evt_AeX_SWD_Package] AS Evt_AeX_SWD_Package

                                                  WHERE      (LEN(URL) > 0) AND (EventType = 'End')) AS PSSource

                  WHERE     (PackageDownloadSourceName NOT IN

                                                       (SELECT     CASE WHEN charindex('.', [Name]) > 0 THEN upper(substring([Name], 0, charindex('.', [Name]))) ELSE Name END AS Name

                                                           FROM          [SQL-W2K8-01].[Symantec_CMDB_2].[dbo].[vNotificationServerSource] AS vNotificationServerSource_1

                                                           UNION

                                                           SELECT DISTINCT vc.Name

                                                           FROM         [SQL-W2K8-01].[Symantec_CMDB_2].[dbo].[vComputer] AS vc INNER JOIN

                                                                                          [SQL-W2K8-01].[Symantec_CMDB_2].[dbo].[SWDPackageServer] AS SWDPackageServer_1 ON vc.Guid = SWDPackageServer_1.PkgSvrId))

                  ) AS PackageDownloadSourceDim

16.png

 

 

This final query merges the first two together in order to provide the complete picture:

 

SELECT psrc.PackageDownloadMethod

         , psrc.PackageDownloadSourceName

         , d.PackageDownloadSourceType

         , psrc.PackageName

         , psrc.Computer

         , psrc.Domain

         , psrc.[IP Address]

         , psrc.[User] 

FROM (

SELECT CASE

      WHEN charindex('http://', [URL]) > 0 THEN 'HTTP'

      WHEN charindex('https://', [URL]) > 0 THEN 'HTTPS'

      WHEN charindex('\\', [URL]) > 0 THEN 'UNC'

      WHEN charindex('Multicast', [URL]) > 0 THEN 'Multicast'

      ELSE ''

END COLLATE DATABASE_DEFAULT AS PackageDownloadMethod

,CASE WHEN charindex('//', [URL]) > 0 THEN upper(substring(substring([URL],

charindex('//', [URL]) + 2, len([URL]) - charindex('//', [URL]) - 1), 0,

charindex('/', replace(substring([URL], charindex('//', [URL]) + 2,

len([URL]) - charindex('//', [URL]) - 1), '.', '/'))))

WHEN charindex('\\', [URL]) > 0 THEN upper(substring(substring([URL], charindex('\\',

[URL]) + 2, len([URL]) - charindex('\\', [URL]) - 1), 0,

charindex('\', replace(substring([URL],

charindex('\\', [URL]) + 2, len([URL]) - charindex('\\', [URL]) - 1), '.', '\'))))

WHEN charindex('Multicast download complete. Master: ', [URL]) > 0

THEN upper(substring([URL], charindex('Multicast download complete. Master: ',

[URL]) + 37, len([URL]) - charindex('Multicast download complete. Master: ',

[URL]) - 36)) ELSE NULL END AS PackageDownloadSourceName

, p.PackageName ,vc.Name AS Computer ,vc.Domain ,vc.[IP Address] ,vc.[User]

FROM Evt_AeX_SWD_Package p

JOIN vComputer vc ON vc.[Guid] = p._ResourceGuid

WHERE (LEN(URL) > 0) AND (EventType = 'End')

AND p.PackageName = 'Desktop Rover') psrc

left outer join vITAnalytics_CMDB_PackageDownloadSourceDim d

on psrc.PackageDownloadSourceName = d.PackageDownloadSourceName

ORDER BY PackageDownloadMethod ASC

17.png

 

Statistics
0 Favorited
0 Views
0 Files
0 Shares
0 Downloads

Tags and Keywords

Comments

Feb 26, 2014 03:39 PM

You should be able to add that join to the query where vComputer is, and add the relevant columns before the "FROM Evt_AeX_SWD_Package" line.

Feb 26, 2014 03:09 PM

Thanks Joe.  I found this info as well after I posted the question.  The events area in resource manager also has the same info in case anyone was wondering but having a way to do this with raw SQL is much faster and easier.

Feb 26, 2014 03:04 PM

Although I did not combine with the other tricks in this post, here is a quick example of how to show detailed information about package downloads.  You will want to add some WHERE clauses to zero in on specifically what you are looking for such as a package name.  This reporting is based on events received from the client so you will see times for Start and Finished events.  If you don't get many results from this query, you may need to enable additional event reporting for software downloads within your client agent policy.

 -- Download Activity
SELECT DISTINCT top 1000
 vc.[Guid] [_ItemGuid],
 vc.[Name] [Computer Name],
 vc.[IP Address],
 ps.[PackageName],
 ps.[status],  
 ps.[TransferRate],
 ps.[Cursor],
 ps.[URL],
 ps.[Time] 
FROM dbo.vComputer vc                                
 LEFT JOIN Inv_AeX_SWD_Package_Summary ps on ps._ResourceGuid = vc.Guid
 

 

Feb 26, 2014 12:06 AM

I haven't had the time yet.

Feb 25, 2014 05:56 PM

Were you ever able to find the start and end times?  We also need to be able to report on this.

Thanks!

Jason

Feb 12, 2014 10:07 PM

This rocks.  Is there another table (or fields) that can show start and end times?   I would like to see if I can trend some of the package downloads with what time the package fired off.

Related Entries and Links

No Related Resource entered.