Highlighted
Occasional contributor

Exessive growth of unrecognized file evidences

Dear Community,

in one of our Systems, we discovered a growing number of unrecognzied file evidences (>9 Million entries). We are using the FNM Agent on all platforms. At the Moment, we do not exclude any folders in the inventory process. I am pretty sure that this causes the raising number of evidences.

Do you have experiences & best practices which folders should be excluded on Windows Clients, Windows Servers, UNIX & Linux Servers? We will start with excluding the Windows Directory and the recycle bin...

Best, Christian

@mfranz 

6 Replies
Highlighted
Intrepid explorer

Re: Exessive growth of unrecognized file evidences

Hello Christian,

We experienced similar problem and after a review decided to exclude some paths from inventory collection.

I cannot confirm if this is 100% safe to exclude those path, but in our case those were not useful in any license calculations.

All those folders contained were some details regarding updates:

%:\WSUS\

%:\WSUSDATA\

%:\WSUSdownloadedPatches\

This folder also contained some useless files.

%:\SCCMContentLib\FileLib

Only these 4 added to 50% of total files evidences we were importing.

For Linux I've also excluded /var/lib/docker/ because it was growing rapidly.

Highlighted
Active participant

Re: Exessive growth of unrecognized file evidences

as JanPie highlighted,

 

For our clients, we do this as an onboarding process to identify folder on both wintel and non-wintel systems which will have 'junk'.

we identify directories, Backup folders, install folder (manual install and or for tools like SCCM)

hope this helps

 

 

Highlighted
Active participant

Re: Exessive growth of unrecognized file evidences

Hi,

Keep in mind that deleting old not reporting and ignored inventory from FNMS Inventory database also helps to reduce number of records in underlying evidence related tables.

Marius

Highlighted
Community Manager Community Manager
Community Manager

Re: Exessive growth of unrecognized file evidences

One environment I was working in found it useful to exclude the /var/spool and /var/log paths on UNIX computers to reduce the size of data collection.

However similar to @JanPie's comments, ultimately what it is useful to exclude will best be driven by your particular data. I've not found that much similarity across different companies in relation to directories that are helpful to exclude.

(Anything expressed here is my own view and not necessarily that of my employer, Flexera. If my reply answers a question you have raised, please click "ACCEPT AS SOLUTION".)