LDMS 2016 (v10.0) - Inventory Brandon Hill Last Updated 2/3/2016

What’s New

Inventory Service Front End Web services for the Inventory service front end Explanation: The Inventory Server has a front end and a back end. The front listens for clients to contact the core, delivers its scan settings, receives the scan data and then writes a scan file to ldscan. The back end watches the ldscan folder, it will pickup miniscans first, followed by the oldest .SCN files until the folder is empty. A new front end web service means clients will be sending their scans through IIS. The back end fundamentals are unchanged.

Web Service Front End (Continued) Using this service is Enabled or Disabled through agent settings Default is Enabled Supports old clients through the same old interfaces (port 5007, PostCGI)

Web Service – Scan Instructions Handles the initial communication from the scanner (PING) PONG data includes sync and reset/update of Device ID’s Also handles CSEP Election Reporting//corename/ScanInstructions/InventoryService/ping/1 IIS Log Example: 2015-09-17 16:34:23 10.16.232.229 GET /ScanInstructions/InventoryService/PING/{5043E293-5581-7846-9ADC-2586C22BB9F8} - 80 - 10.***.***.*** - - 200 0 0 378 (on core server)

Web Service – Scan Instructions (Continued) postingData Receives the scan files from the client The Service decides if the file will need to be decompressed and, if so, puts it into the ldscan/decomp folder Will append the session address (if set to do so) IIS Log Example: 2015-09-17 16:15:25 10.***.***.*** POST /postingData/scan.upload prefix=ldscan&suffix=Update%20Settings 443 - 10.***.***.*** LANDESK+Handler+update - 202 0 0 4879

Default max scan file size = 20 Mb Up from 10 MB previously Inventory Service Default max scan file size = 20 Mb Up from 10 MB previously Removes stale CSEP records during DB maintenance Notifies the web service (scaninstructions) when something is added or removed from the cached lists Out of Sync Device ID reset/update The max scan size value will only change if it is set to 10. If the admin has already changed it then it will be left alone.

Inventory Service (Continued) The mutex (how it isolates a record to work on) has been moved to the database. This was done to prevent simultaneous record updates. Added Network ID under Bound Adapter (mask/bits)

Inventory Service - Maintenance Log Purged Records – Enhanced If you are investigating records mysteriously disappearing this enhancement will help. We enhanced Log Purged Computers so it will log aged out machines (as it does in 9.6) as well as machines removed due to other maintenance actions. This applies to inventory maintenance. For tracking machines being deleted from the console please use the auditing feature in the product to track that.

Inventory Service – Maintenance (Continued) PurgeComputers log will have entries like this: Purging duplicate computer records: 1/21/2016 1:01:01 AM Delete Duplicates On Device Name And NIC Address slc-ComputerDuplicate, 1/8/2016 9:58:33 AM Purging duplicate computer records: 1/22/2016 1:00:51 AM Purge Old Computers slc-computer2, 10/23/2015 9:06:08 AM Purging duplicate computer records: 1/23/2016 1:00:32 AM Purge Old Computers Slc-computer3, 10/24/2015 9:03:01 PM The first type of log entry you will see is Purging duplicate computer records: will show anything purged because it was a duplicate based on the “Devices” settings in inventory. It will timestamp the time maintenance ran for this operation. The next type of log entry you will see is Purge Old Computers. It will show the device name and the last updated by inventory date of that record. So users are able to validate, yes it was removed because it has not updated inventory or even sent a miniscan within the configurable age threshold.

Inventory Scanner - Windows Gathers Application Crash Data From the Application event log where Source = “Application Error” Example: Diagnostic Data - Application Errors - (Application Name:Ssms.exe) - Application Version =2011.110.3000.0 Diagnostic Data - Application Errors - (Application Name:Ssms.exe) - Application Time Stamp =1350681037 Diagnostic Data - Application Errors - (Application Name:Ssms.exe) - Faulting Module =KERNELBASE.dll Diagnostic Data - Application Errors - (Application Name:Ssms.exe) - Faulting Module Version =6.3.9600.17415 Diagnostic Data - Application Errors - (Application Name:Ssms.exe) - Faulting Module Time Stamp =1414548190 Diagnostic Data - Application Errors - (Application Name:Ssms.exe) - Application Path =C:\Program Files (x86)\Microsoft SQL Server\110\Tools\Binn\ManagementStudio\Ssms.exe Diagnostic Data - Application Errors - (Application Name:Ssms.exe) - Last Exception Code =c0020001 Diagnostic Data - Application Errors - (Application Name:Ssms.exe) - Last Exception Date =1439419076 Diagnostic Data - Application Errors - (Application Name:Ssms.exe) - 30 Day Count =1 Diagnostic Data - Application Errors - (Application Name:Ssms.exe) - 90 Day Count =4

Inventory Scanner – Windows (Continued) Gathers boot degradation info From the "Applications And Services Logs" Event log under "Microsoft-Windows-Diagnostics-Performance/Operational (100 < Event ID < 111) Example: Diagnostic Data - Boot Degradation - (Name:MachinePolicyApplication) - Last Event Date =1440595744 Diagnostic Data - Boot Degradation - (Name:MachinePolicyApplication) - Event ID =107 Diagnostic Data - Boot Degradation - (Name:MachinePolicyApplication) - Degradation Time =317 ms Diagnostic Data - Boot Degradation - (Name:MachinePolicyApplication) - Total Time =571 ms Diagnostic Data - Boot Degradation - (Name:MachinePolicyApplication) - 30 Day Count =1 Diagnostic Data - Boot Degradation - (Name:MachinePolicyApplication) - 90 Day Count =1

Inventory Scanner – Windows (Continued) Gathers system crash data Counts the number of minidump files in the folder pointed to by HKLM\\SYSTEM\\CurrentControlSet\\Control\\CrashControl\\MinidumpDir Example: Diagnostic Data - System Failures - Last Failure Date =1411569576 Diagnostic Data - System Failures - 30 Day Count =0 Diagnostic Data - System Failures - 90 Day Count =0

Inventory Scanner – Windows (Continued) Sends Last Logon Event data (as written to the registry by Local Scheduler) Can disable from an agent setting "Do not send logon/lock event dates“ Example: OS - Last Logon Date OS - Last Logoff Date OS - Last Lock Date OS - Last Unlock Date

Troubleshooting For this training we will only focus on troubleshooting the connectivity and web service portion as that is new. Please refer to the Community Inventory Landing Page for the best practices on troubleshooting the various other components of Inventory.

Client Contacting the Core LDMS 10 agents by default will contact the core server web service over port 443. The client must be able to resolve the corename in its client connectivity settings. The web service front end needs to have loaded successfully. The front end caches data when it starts. So if there is an IIS problem or a problem with the data it is caching the front end may not load correctly. Many other client functions also use this port, so if 443 is the problem then likely other components will be broken as well.

Client Contacting the Core (Continued) How do I know I might be having trouble connecting to the core or web service or it failed to load? In the event the front end web service doesn’t load, clients wont get response when they manually run the scan. No SCN, MP or MINI files will show up in the ldscan folder. The IIS logs under W3SVC1 will show non 200 (success) http codes for when the scanner hits IIS if it didn’t load correctly. Look for the lines where these are hit: postingData & ScanInstructions to see what http codes you get. Scaninstructions will return 412 (precondition failed) when it is unable to load scaninstructionsdata which references the following assemblies : Landesk.dataservices.dll Landesk.dataservices.database.dll Landesk.managementsuite.data.dll Landesk.managementsuite.database.dll Landesk.managementsuite.keyvalue.dll If one of those is not there or functioning properly, it would cause the error. 

Client Contacting the Core (Continued) You can also turn off post to web in the client settings to see if that allows the client to get through. If so you narrowed the problem to the web service / communication path. ScanInstructions.dll also has a log, its log becomes more useful if the logsql registry key is set on the core. What if files are being put into ldscan and post to web is enabled? Then the Web Service did load and at least some clients are getting through. Refer to standard troubleshooting at that point.

Questions?

Coming Feature – Performance Degradation Events Performance Degradation events for the Inventory Service is a feature that will be coming to the 2016 (v10.0) release following the initial offering. It is disabled by default in the database until a later feature update. Contact Support for questions. This functionality will be added through either a component patch or service pack.

Inventory Service (Continued) Self Monitoring (Degradation Monitoring) Settings in svccfg / inventory / advanced settings Degradation Threshold (percent) - default 20 Degradation Sample (minutes) – default 15 Stores average times in kb/sec File I/O, DB Access, Processing (parsing) Stored in the InventoryTimings table in the DB If any are degraded by more than the threshold: A ServiceDegradation alert is sent An event is written to the Windows Event Log

Inventory Performance Degradation Event Inventory updates a row in the DB with the running average. If the last scan is below the running average (since this setting is first enabled) then it will log a message. This will continue if performance is below the running average until the averages align.

Thank you