details of evidence

[jrsikors]

Hello -

We are pretty new to Flexera.

Very simple scenario:
Flexera says I am consuming an Acrobat 11 Std license because it's installed on my laptop

(I don’t have it installed)

How can I figure out WHY Flexera thinks I have Acrobat Systems Acrobat XI?

Is there a screen I can click to that says basically:
Flexera says you have Acrobat 11 Std installed because you have Acrobat.exe in your C:\Jeff folder and the file version says 11

I’ve clicked through a bunch of Evidence screens, but I haven’t found a place where I can find a SIMPLE answer to that scenario.  I can’t even find a difficult answer !

I think i have tracked it down to Installer Evidence properties... and the 

Name: Adobe Acrobat
Version: 11.0
Publisher: regid.1986-12.com.adobe%
Type: Any
Source: Flexera

So my question is -- how can i figure out which particular file or registry key on my laptop is "triggering" the above evidence?

IE:
Is there a file on my computer and if i right click -> properties, i will see the publisher as regid.1986-12.com.adobe

Thanks!
Jeff

[jrsikors]

update...

I found:
C:\programdata\regid.1986-12.com.adobe

on my machine.

Is there a place in Flexera, or the database, that stores the location C:\programdata\regid.1986-12.com.adobe as "the reason why" the evidence is linked to my machine?

Thanks,

Jeff

[mfranz]

Hi Jeff,

I would go with the raw data from the inventory database (FNMSInventory).

SELECT
	c.ComputerCN
	,so.InstallationDate
	,sitf.OriginalArpPublisher
	,sitf.OriginalArpDisplayName
	,sitf.OriginalArpDisplayVersion
FROM SoftwareOccurrenceSoftwareIsoTagFile sositf
JOIN SoftwareOccurrence so
	ON sositf.SoftwareOccurrenceID = so.SoftwareOccurrenceID
JOIN SoftwareIsoTagFile sitf
	ON sositf.SoftwareIsoTagFileID = sitf.SoftwareIsoTagFileID
JOIN Computer c
	ON so.ComputerID = c.ComputerID

This won't give the the actual link to the application, but you should be able to gat a quick overview. From there the data is consumed in multiple import steps (ManageSoft Reader):

• GetDistinctISOTagInstallerEvidence
• GetISOTagInstallerEvidence
• GetISOTagInstalledInstallerEvidence

As can be seen in the Reader SQL code, from there the data is treated as InstallerEvidence with EvidenceType "SWIDTag".

Best regards,

Markward

[jrsikors]

Thanks for the reply!

So i only have 24 records in my SoftwareOccurrenceSoftwareIsoTagFile table, all are different computers but 1 software title
979 in my SoftwareIsoTagFile table
3.8 million in SoftwareOccurrence .

So something must not be configured right?

Thanks!
~Jeff

[jrsikors]

To ask it a different way: this would be my dream results from a database query.

Computer Name	Software We Say You Have	Evidence Trigger Name	Evidence Trigger Publisher	Evidence Directory on Local computer	Evidence File on Local computer
JeffsComputer	Adobe Acrobat 11 Std	Acrobat XI Standard	regid.1986-12.com.adobe%	C:\ProgramData\regid.1986-12.com.adobe	regid.1986-12.com.adobe_V7{}AcrobatCont-12-Win-GM.swidtag

Flexera was saying my machine had Adobe Systems Acrobat XI Standard.  I didn't have it installed, so I wanted to know why Flexera *thinks* I have it.  

Clicking through the screens -- you get to this screen, however there are a couple issues, mainly that there are 34 different types of evidence, and no easy way to know which of these 34 my computer fell into.

Then when you get lucky and figure out that it's because of regid.1986-12.com.adobe% , it still doesn't tell me where on my computer this exists.

[mfranz · Accepted solution]

You mean like

SELECT
	c.ComputerCN [Computer Name]
	,st.FullName [Software We Say You Have]
	,tv.ProductTitle [Evidence Trigger Name]
	,tv.ProductVersionName [Evidence Trigger Version]
	,te.RegID [Evidence Trigger Publisher]
	,sfp.Path [Evidence Directory on Local Computer]
	,sfn.Name [Evidence File on Local Computer]
FROM FNMSInventory.dbo.SoftwareFile sf
JOIN FNMSInventory.dbo.SoftwareFilePath sfp
	ON sf.SoftwareFilePathID = sfp.SoftwareFilePathID
JOIN FNMSInventory.dbo.SoftwareFileName sfn
	ON sf.SoftwareFileNameID = sfn.SoftwareFileNameID
JOIN FNMSInventory.dbo.SoftwareIsoTagFile tf
	ON tf.SoftwareIsoTagFileID = sf.SoftwareIsoTagFileID
JOIN FNMSInventory.dbo.SoftwareIsoTagSoftwareVersion tv
	ON tv.SoftwareIsoTagSoftwareVersionID = tf.SoftwareIsoTagSoftwareVersionID
JOIN FNMSInventory.dbo.SoftwareIsoTagEntity te
	ON te.SoftwareIsoTagEntityID = tv.TagCreatorEntityID
JOIN FNMSInventory.dbo.Computer c
	ON sf.ComputerID = c.ComputerID
LEFT JOIN ImportedInstallerEvidence iie
	ON tv.ProductTitle = iie.DisplayName
		AND tv.ProductVersionName = iie.Version
		AND te.RegID = iie.Publisher
		AND iie.Evidence = 'SWIDTag'
LEFT JOIN ImportedInstallerEvidenceMapping iiiem
	ON iie.ExternalInstallerID = iiiem.ExternalInstallerID
		AND iie.ComplianceConnectionID = iiiem.ComplianceConnectionID
LEFT JOIN SoftwareTitleInstallerEvidence stie
	ON iiiem.InstallerEvidenceID = stie.InstallerEvidenceID
LEFT JOIN SoftwareTitle st
	ON stie.SoftwareTitleID = st.SoftwareTitleID

?

[jrsikors]

Nice!!!  You are awesome, thanks so much.  That is beautiful !

~Jeff

[ChrisG]

The following post and discussion in the associated thread may also be helpful to answer questions like this if you are using FlexNet On-premises: Unrecognized Evidence Report

If you are using FlexNet Cloud, then the new feature described in the following post would also help with this: Ever question why a software installation in FNMS is showing up?

[jrsikors]

Thanks Chris -

I do have some follow-up questions now.

In the article it says if you are Cloud you see the "Evidence" tab.  Is this also released to on-premise?  We are currently on

Product version: FlexNet Manager Suite 2018 R2
Release number: 13.1.1.712

Next question, kind of back to my original question... 
I deleted the file that Flexera was "using as evidence against me" the other day.  It's still showing up that I have it installed, and using the query i'm still seeing:

Computer Name	Software Name	Evidence Trigger Name	Evidence Trigger Version	Evidence Trigger Publisher	Evidence Directory on Local Computer	Evidence File on Local Computer	HWDate	swdate
jeffscomputer	Acrobat XI	Adobe Acrobat	11	regid.1986-12.com.adobe	C:\ProgramData\regid.1986-12.com.adobe\	regid.1986-12.com.adobe_V6{}AcrobatPro-AS2-Win-GM-MUL.swidtag	8/27/19 1:56 PM	8/27/19 1:56 PM

When should I expect that the evidence will be unlinked from my device?

I did/am having an issue where reconciliation failed last night, and there is another system task that can't run, posted about it here:
https://community.flexera.com/t5/FlexNet-Manager-Forum/run-system-task-manually/m-p/113367#M2303

So maybe that's related.

Another question -- but I'll probably try to figure it out on my own unless anyone has the answers handy... the query I was given seems to only be for 1 of the many evidence scenarios?  In other words, that query only seems to be giving back results for software/evidence that has to do with the "regid-xxxxxxxxxxx" scenarios?

Thanks!
~Jeff

[JohnSorensenDK]

@jrsikors 

The "Evidence" tab is not yet released for the on-premise version, it's expected to be included in the 2019 R2 release later this year.

Thanks,

[mfranz]

Hi Jeff,

Different evidence types (file, installer, WMI) have different data schemas in the database, so reports for other evidence types will have to target different tables and views.

Best regards,

Markward