Unrecognized Evidence Report

[agrawalakshay1]

Is there a way to run a report on Unrecognized Evidence?

I'm currently running a report on Installed Devices (Using the Installations metric), which gives me a device name for all computers running a software title by version. Is this possible using Unrecognized Evidence as well?

[marius · Accepted solution]

Hi, 

Installer or file evidences are not in the data model of FNMS reports builder, so you can't build reports with report builder that include evidences. It would be beneficial to have evidences added to the data model, however at the moment you can only rely on workarounds.   

Currently it is possible to fetch list of Inventory devices having one or another evidence directly from FNMS Database. It is also possible to map such custom SQL query on reports builder and show results in WebUI.  Attaching example SQL code for the report I am currently building in our environment, it allows to create report returning the list of devices having installer evidence. 

Marius 

[nrousseau1 · Accepted solution]

Hello Akshay,

I have two reports I would like to share on evidences.

• As Kenza said, the "Evidences on Computers" report allows to see evidences on a specific computer ("ComputerName|”) with their link to recognized applications (or not). If you want to see all evidences across computers with a specific name, just use “| EvidenceName” as a filter. “ComputerName|EvidenceName” will show the raw evidence (fuzzy matching on the evidence name (%EvidenceName%) on the computer (exact matching on the computer name). I attach the latest version (v14)

 

• The second report on the following page shows all licensed installations with the evidences that allowed to recognize the installations: Raw Evidence on Computers custom SQL report. This gives an end to end explanation (this raw evidence triggered this installation to be recognized, that consumes this license)

[mgunnels]

Good Afternoon,

You can view unrecognized Evidence in the webui and export to excel by going to ‘License compliance\ unrecognized Evidence’. Unfortunately, that will not tie to a device.

I have never seen an option to build a report in the ‘Report Builder’ that includes evidence.

I certain there is not currently an option for that type of report in the UI.

Are you using cloud of on prem?

[marius · Accepted solution]

Hi, 

Installer or file evidences are not in the data model of FNMS reports builder, so you can't build reports with report builder that include evidences. It would be beneficial to have evidences added to the data model, however at the moment you can only rely on workarounds.   

Currently it is possible to fetch list of Inventory devices having one or another evidence directly from FNMS Database. It is also possible to map such custom SQL query on reports builder and show results in WebUI.  Attaching example SQL code for the report I am currently building in our environment, it allows to create report returning the list of devices having installer evidence. 

Marius 

[mfranz]

@marius that is a good looking report. @agrawalakshay1 to get only unassigned evidences add this to the WHERE clause:

IEI.IsAssigned = 0

Also IEI.OperatorManagedState and IEI.Ignored might be interesting, to see if the evidence is ARL based or local and maybe ignored on purpose.

[jaalstead]

Marius,

I just put this into our DEV environment and my Asset Management Team LOVES it. In fact, they love it so much they want to PROD ASAP. In addition, they were wondering if you had something similar for FILE evidence?

Thanks!

Jason

[marius]

Hi, jaalstead, glad your team liked the report. I am still making final adjustments of shared Installer evidence report, later I will build report for File evidences. I can share it with you in couple weeks. If you want to have it faster just rewrite SQL by using listed tables instead of ones related to Installer evidences. [FNMSCompliance].[dbo].[InstalledFileEvidence] [FNMSCompliance].[dbo].[FileEvidenceInfo] [FNMSCompliance].[dbo].[SoftwareTitleFileEvidence]

[jaalstead]

Marius,

Thanks for the hint, but with a busy as we are I likely wouldn't get to it before you! If you could send me an update when the File evidence is complete that would be fantastic!

Jason

[marius]

Hi, @jaalstead ,

finally got some time to finalize reports. Attaching scripts that we are going to deploy into production. 

In zip file you will find two reports one for Installer evidences, another for File evidences. 

• CR03 - Inventory devices by Installer evidence 
• CR07 - Inventory devices by File evidence

Marius

[jaalstead]

Thank you! Already implemented and our Asset Team loves it.

Quick Question: Is there documentation to create custom reports like this someplace?

[marius]

Hi, I was not able to get documentation. So it took some time to analyse existing default reports and build own. Used Nicolas Rousseau's reports to find existing tables, and then used trial and error approach. 

On documentation request I got this response from @ChrisG :

"Frankly, when getting to this level of tweaking you are starting to work with internal system details that are not intended to be directly accessed or used - hence you won't find any documentation for this. I'm not wanting to discourage you from being adventurous and enjoying the power of working directly at this level, but please understand that it is an approach that you won't find any formal support for."

[ghaitik]

Nicolas Rousseau's  "evidences on computer (NR)"report may help on that .

It is very useful in a lot of my investigations... You can either :

1. Filter on a device and get all the evidences that have been gathered on it, with a a column showing the mapped applications that can therefore lead you to identify the unmapped/unrecognized evidences on the specific device
2. Filter on a specific application and then you get all the devices with the evidences that triggered the recognition of the application.

You'll find the SQL script for the view enclosed, but you may check with him if he doesn't have a more recent version of it !

[nrousseau1 · Accepted solution]

Hello Akshay,

I have two reports I would like to share on evidences.

• As Kenza said, the "Evidences on Computers" report allows to see evidences on a specific computer ("ComputerName|”) with their link to recognized applications (or not). If you want to see all evidences across computers with a specific name, just use “| EvidenceName” as a filter. “ComputerName|EvidenceName” will show the raw evidence (fuzzy matching on the evidence name (%EvidenceName%) on the computer (exact matching on the computer name). I attach the latest version (v14)

 

• The second report on the following page shows all licensed installations with the evidences that allowed to recognize the installations: Raw Evidence on Computers custom SQL report. This gives an end to end explanation (this raw evidence triggered this installation to be recognized, that consumes this license)

[nrousseau1]

second report.

[kathy_allen]

@nrousseau1 when I download this report, it says version 13 April 2018. Is that the right report? The filename references v14

[mrichardson]

Hi @kathy_allen ,

While I can't comment on the custom report, have you seen this thread as it relates to a feature we added to help with evidence / application recognition?

That feature is something that will be kept current with releases.

Hope this helps,
Matt

[ChrisG · Accepted solution]

The attached script can be run against the FlexNet compliance database for an on-premises installation to configure a range of custom report objects that may be helpful for troubleshooting and digging in to raw evidence details and application recognition results. These report objects will expose details of evidence that has been imported, and how that evidence maps to inventory devices, recognition rules and applications.

The following objects (and associated relationships) are defined:

• Raw installer evidence: Raw installer evidence details imported from inventory sources
• Installer evidence: Installer evidence recognition pattern configured in the ARL
• Raw file evidence: Raw file evidence details imported from inventory sources
• File evidence: File evidence recognition pattern configured in the ARL
• File evidence rule: File evidence recognition rule
• Raw WMI evidence: Raw WMI evidence details imported from inventory sources
• WMI evidence: WMI evidence recognition pattern configured in the ARL

It is easy to generate reports containing massive amounts of data with these objects. For example, you could easily build a report listing all raw file evidence found on all computers (ouch!). Use prudent filtering to avoid generating too much data!

Some example screenshots of reports that can be configured using these objects follow.

A consideration to be aware of with these custom report objects is that they rely on data that is directly written into the compliance database by inventory "reading" processes that extract data from inventory sources (such as SCCM, the FlexNet inventory database, etc). As such, it may take a long time to run reports using these objects while inventory "reading" processes are running. I can also imagine some possible situations where the data shown in the reports may be unreliable if reports are run between when inventory "reading" and "writing" processes are run.

[marius]

Hi, @ChrisG ,

your provided script to extend data model looks very promising, as it should enable number of evidence related elements in the FNMS reports. 

Data model extension is developed, any thoughts why it is not added to build-in data model. Do you see any risks on future upgrades if this data model extension will be deployed on on-premise setup? 

Marius 

[ChrisG]

@marius - as a customization, it is certainly possible that a change may be made in a future FlexNet release which results in the data model extension no longer working. However I expect (without testing) that the extensions will work with all current FlexNet releases, as the database schema involved is not something that has changed for many years.

[lcfernandez]

Is still working this  in 2019 R2? or 2020 R2?.

Thanks.

[kclausen]

@lcfernandez - The "Evidence" tab on an inventory device was added as a standard feature in FNMS 2019 R2.

[lcfernandez]

@kclausen , i know, but what we wanted is export for all devices who have evidences for a specified vendor.

Regards.