binit-dh
Level 3

Oracle Programmer application installer evidence found without users actually have it installed

Hi, We have found installer evidence for Oracle Programmer with over 200 instances mainly on end user computers.

In Programmer evidence we only have installer evidence and no file evidence  linked to it, same was the case when we checked device app evidence.

As checked with few potential users they don't have this installed in their machines not sure what is the cause of this false positive evidence? I have noticed that most of this users have SQL developer installed not sure if this is related in anyway?

I have check a similar post https://community.flexera.com/t5/FlexNet-Manager-Forum/Oracle-Programmer-found-by-FNMS-Evidence-foun... 

But seems there was a file evidence  comps.xml linked here, but in my case it's just the installer evidence, I have attached the snapshots.  As this is a commercial software we have identified it as a potential risk.  Any help on this will be appreciated ?

 

0 Kudos
4 Replies
ChrisG
Community Manager Community Manager
Community Manager

The Raw Evidence Type of "OUI" shown in the Device.PNG attachment suggests that this evidence is likely coming from Oracle Universal Installer comps.xml file(s) that are on the file systems of these computers.

The following article provides some more information about these files and how they are used by the FlexNet inventory agent while gather inventory: Information about Oracle Universal Installer (OUI) evidence gathered by the FlexNet inventory agent. In particular, note the following section of this article:

Installation directories that no longer exist

Anecdotally, it is not uncommon to find comps.xml files are not reliably updated by Oracle Universal Installer to indicate Oracle applications are no longer installed when an uninstalled is performed. This can result in FlexNet Manager Suite recognizing installations of Oracle applications based on the evidence, despite other files associated with the installation no longer being on the computer.

The FlexNet inventory agent versions 2021 R1 (17.0) and later contain and improvement that will only return evidence from comps.xml files where the directory specified in the INST_LOC attribute actually exists. Earlier agent versions return all evidence as specified in the comps.xml file, regardless of whether referenced installation directories actually exist.


If you take a look in the inventory agent's tracker.log file from some of these computers you may see details in there indicating specifically where the agent has found comps.xml files on the filesystem, and then you can look in those files for further details.

(Did my reply solve the question? Click "ACCEPT AS SOLUTION" to help others find answers faster. Liked something? Click "KUDO". Anything expressed here is my own view and not necessarily that of my employer, Flexera.)
0 Kudos
Ronny_OO7
Level 7

Hi,

This is a known bug that is fixed in 2021R1. And is caused by coms and inventory.xml that is being read and contains old false installations.

Only way to solve this is using the latest FNMS agent. 

 

Regards

Ronald 

0 Kudos

We are already using the latest version 2021R1
0 Kudos

then it should be resolved. I have not tested this..

0 Kudos