Stale Evidence

[rclark0]

What is the best way to manage stale evidence? We have a device that had the Flexnet agent installed and collected inventory. It appears the Flexnet Agent is no longer working on this device which is not a huge concern since we now collect data through SCCM. We do have an issue were its still reporting on old evidence that was found in the Flexnet agent scan from months ago. 

Is there a way to set the FNMS agent data to become ignored after so many days?

SCCM inventory is set to primary.

Thank you.

[rclark0]

[mfranz]

Hi,

The "Overlapping Inventory Filter" could help (see bottom):

Best regards,

Markward

[rclark0]

i tried this but it didn't seem to clean up the aged evidence. 

[mfranz]

Hi,

Please check you stale inventory. Here is an example showing all (software) inventory older than 90 days.

USE FNMSInventory
SELECT *
FROM Computer c
JOIN InventoryReport ir
	ON c.ComputerID = ir.ComputerID
WHERE DATEADD(DAY,90,SWDate) < GETDATE()

With minimal changed to the query, you can then remove unwanted inventory.

Best regards,

Markward