cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Where is beacon status logged?

Dear Flexera community,

When going to the FNMS beacon overview, all beacons are shown with aditional information such as connectivity status, beacon status and policy status. I was wondering where this information is logged (if it is at all). I want to use such data in Splunk. 

I have looked into the logs on the beacon servers itself and also the beaconstatus.log on the processing server but none of these logs tell if a beacon is down/operating or not.

Is this information logged and if so, where can I find this?

Thanks

(1) Reply

Hello,

This information if is visible in WebUI then is stored somewhere in the Sql database.

The information from beacon is transmitted in a file, with status .bstat which is a xml formatted file. You can catch this file directly on the beacon server or on application server you activate the replication functionality 

What I did, for one of the customer, I created a simple sql script, that will leverage the SQL send email functionality, it's for a multi tenant implementation, but you can modify it out

DECLARE @xml NVARCHAR(MAX)

DECLARE @body NVARCHAR(MAX)

SET @xml = CAST((

select t.TenantName as 'td',' ',b.BeaconName as'td',' ',b.LastKnownActivityTime as 'td',' '  from Beacon_MT b

                left join Tenant t on t.TenantID = b.TenantID

                where b.LastKnownActivityTime < getdate() - 1

FOR XML PATH('tr'), ELEMENTS ) AS NVARCHAR(MAX))

SET @body ='<html><body><H3>Beacon no longer reporting</H3>

<table border = 1>

<tr>

<th> Tenant Name </th> <th> Beacon Name </th> <th> Last Known Activity </th></tr>'   

 

SET @body = @body + @xml +'</table></body></html>'

 

EXEC msdb.dbo.sp_send_dbmail

@profile_name = 'mail2', -- replace with your SQL Database Mail Profile

@body = @body,

@body_format ='HTML',

@recipients = 'flexera_admin@acme.com', -- replace with your email address

@subject = 'Beacon no longer reporting' ;

This script will send me on every morning the beacons that are no longer reporting.