Application installed, only evidence is Uninstall

[marcog]

Hi all, I have an interesting question

On a device we saw on FNMS reports that there was an unwanted and commercial application (Oracle database In Memory), so the customer decided to uninstall it, so that he don't need to pay for it anymore.

But when we scan again the device, the application is still there. The only thing I saw is changed is that in Evidence tab of device property, the only thing remaining is a raw evidence type "Uninstall".

Does this mean that the uninstaller is still there? But in this case why FNMS is considering it in the license?

Is there a way to not include it in the licence compliance?

Or maybe I'm simply giving a wrong meaning, or, I'm not so good in FNMS as I think 🙂

Pasting screenshots

I'm also attaching a screenshot of the history tab, also if I think it is not important. 

Dear community, thanks for your support.

[jjensen]

Hello @marcog,

This article may be of some use here: What is "Uninstall" evidence? 

To summarise, it is data that is typically extracted from the following registry keys:

[HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall] (32-bit applications)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall] (64-bit applications)

I'd suggest that perhaps the application uninstall has left behind some residual data.

HTH,

Joseph

[marcog]

As far as I know they are unix servers.
Precisely they are
Oracle Linux Server

[JeffVoss]

get a copy of the NDI file, may be .ndi.gz from the server.

edit the file and search for the raw evidence found.

the evidence found should be detailed enough to find what is causing it to flag, so you should be able to remove the evidence.

My experience is the Oracle uninstall leaves evidence behind regularly. 

[jjensen]

@marcog - thanks for clarifying the OS.

In this scenario, I suspect that Database In-Memory remains within your installed applications list because several of the Oracle instances associated with that inventory device are still reporting non-zero results for 'Installed', based on the DB inventory queries executed by the InventorySettings.xml. From memory, these entries relating to Oracle instances do show up with evidence type 'Uninstall'.

Checking the tracker.log should show you which query is returning a non-zero install result for Database In-Memory against each instance. If you dispute the accuracy of this, it may be worth raising a support ticket to investigate the specifics of the query.

[robinjaiswal]

Dear Marco

Do suggest the steps if you were able to resolve that??

Regards,

Robin

[marcog]

Sadly, I did not resolve the doubts.
I found some examples where also having only that evidence, the software was completely installed and used by the customer. So I'm not considering that a realiable information anymore.