search cancel

What can we know about Detection Checks from entries in the Agent Logs

book

Article ID: 256344

calendar_today

Updated On:

Products

Client Management Suite IT Management Suite

Issue/Introduction

Questions and Answers about viewing Agent Logs from Detection Checks.

Environment

Release : 8.6

Resolution

This information will follow the following flow: Agent Logs, followed by comments.

Policy {DF19EE9E-B565-47D5-BFF2-32A699DB834A}Adobe Acrobat DC 21.001.20145 has no valid future scheduled run time (other than logon or startup schedules). Net job item = {Index = 0, State = NotStarted, Status = Detected, LastCheckTime = 2022-12-01 09:30:00 -6:00, LastRealRunTime = 2022-10-31 06:15:01 -6:00}
-----------------------------------------------------------------------------------------------------
Date: 12/1/2022 10:39:05 AM, Tick Count: 139015 (00:02:19.0150000), Host Name: INSIGHT-H34FDK3, Size: 559 B

I assume Detected = detection check was successful?  YES

_Policy {DF19EE9E-B565-47D5-BFF2-32A699DB834A}Adobe Acrobat DC 21.001.20145 has no valid future scheduled run time (other than logon or startup schedules). Net job item = {Index = 0, State = NotStarted, Status = Detected, LastCheckTime = 2022-12-01 *10:39:12* -6:00, LastRealRunTime = 2022-10-31 06:15:01 -6:00}

_
-----------------------------------------------------------------------------------------------------
Date: 12/1/2022 10:39:12 AM, Tick Count: 146187 (00:02:26.1870000), Host Name: INSIGHT-H34FDK3, Size: 559 B

The LastCheckTime is the exact time of the message being logged?  The LastCheckTime is last time when the current job item was checked if it is due. This is required for calculation of NextRunTime.  It is set/reset in so many places that without trace level logs I cannot tell from the code what caused its change, but no, it is NOT the time when the message is logged.

Policy {DF19EE9E-B565-47D5-BFF2-32A699DB834A}Adobe Acrobat DC 21.001.20145 has no valid future scheduled run time (other than logon or startup schedules). Net job item = {Index = 0, State = Started, Status = InProgress, LastCheckTime = 2022-12-01 11:08:42 -6:00, LastRealRunTime = 2022-12-01 11:08:42 -6:00}
-----------------------------------------------------------------------------------------------------
Date: 12/1/2022 11:08:41 AM, Tick Count: 1914921 (00:31:54.9210000), Host Name: INSIGHT-H34FDK3, Size: 559 B

LastCheckTime and LastRealRunTime being in the future one second from when message is written. Good catch!  Plus one second is by design  - for the sake of proper handling.

Policy {DF19EE9E-B565-47D5-BFF2-32A699DB834A}Adobe Acrobat DC 21.001.20145 has no valid future scheduled run time (other than logon or startup schedules). Net job item = {Index = 0, State = Started, Status = InProgress, LastCheckTime = 2022-12-01 11:08:42 -6:00, LastRealRunTime = 2022-12-01 11:08:42 -6:00}

 

This sequence shows we lost the LastRealRunTime of 10/31/2022 somehow.  Is that recorded in an agent file somewhere like AeXSWDPolicy.xml? 

As mentioned above when MDP (Managed Delivery Policy) policy is removed it clears its execution state.  The state is maintained under C:\Program Files\Altiris\Altiris Agent\Agents\SoftwareManagement\data\policyguid.  It is only used for the purpose of reboot or  SMA restart. Although It is not cleared when policy goes away, it will be overwritten “from scratch” when the policy comes back.

 

Is LastCheckTime the time the Detection Check started or just when the agent looks last to see if the Detection Check needs to run?  Any insight into what these messages are referring to (State / Status / LastCheckTime / LastRealRunTime) would be helpful.

The LastCheckTime is last time the current job item was checked if it is due. This is required for calculation of NextRunTime  policy trigger.  The LastRealRunTime is last time the current job item was last started – required for UI. 

Possible values for state and statuses are below.

Unknown, Success, Failure, InProgress, RebootPending, Detected, Not Detected,  Not Applicable (for Detection Rule, and also Download Task) and Skipped