Oracle Java file evidence - not sure if it is accurate
I'm running through some reports following a clean-up of Oracle Java, i noticed a device evidences showin two differing results from agents Altiris and Flexera, which are installed on this server.
The Java was removed, but the Evidence still showing, is this meant to clean-up after the removal??
Looking at the screenshot that you have provided, the evidence coming from Flexnet Manager Suite is most likely stale, given the last inventory date that is shown in the screenshot. To remedy this, I would recommend running a new scan with your Flexnet Manager Suite inventory source on this machine.
As for the evidence from Altiris, this evidence is an Uninstall registry key. This was most likely missed by the uninstaller when the Java application was uninstalled. You (or your IT team)can remove this Uninstall evidence from the registry manually.
You can find more information, and the location of this registry key in the knowledge base article below:
What is "Uninstall" evidence?
If my reply answers a question you have raised, please click "ACCEPT AS SOLUTION".
@cartejam - If you go back and look at your original image that you provided that is showing the raw evidence being picked up, they are showing very old "Last Inventory Dates". This implies that something has happened where both the Flexera Agent and the Altiris Agent are not reporting in current inventory for this specific server.
The Flexera Agent shows a last inventory date of October of 2021.
The Altiris Agent shows a last inventory date of January of 2022.
Correct the dates are older for the evidence inventory than the agent inventory, so that is why i'm baffled here.
I even deleted the record in flexera, for one server for it to re-create, hoping it would not bring in this old evidence, it still did, it recreated the server and the old evidence with those dates!
I'm concerned that something is not right with the reconcile, but where do i start to look???
Hello @cartejam ,
Are you saying Altiris provides a refreshed view and not FNMS? You still see a Java.exe evidence?
Are you seeing in the evidence tab an inventory date that is recent too? Or maybe two inventory dates?
You can use the "Application Transparency" report released earlier this week... actually, it will show all the details on Java next week if you are in the US Cloud (or it has already the data if you are in EMEA).
A couple of likely causes to consider here are:
- Have you somehow ended up with multiple raw computer records (including one old/out of date record) with FlexNet inventory agent data? A good way to check that is to look up the computer in the Inventory Device Matching page in the UI to see what raw computer records have been merged into the one inventory device record you see.
- Has the FlexNet agent actually recently uploaded fresh inventory? Details on the Inventory Device Matching page will likely give some insight here, but you could also check the agent logs (particularly C:\Windows\Temp\ManageSoft\tracker.log) on the client computer itself to verify activity.
So i think you are on to something here, in the device match i see this, which makes me think something is not right.
I do remember one thing, i moved the altiris invenory to my other beacon, not sure exactly when, this is as i will be decommissioning the on prem beacon
Please can you tell me what i need to do to fix this, if this is an issue i have found
It sounds like all of your old inventory data from your prior Altiris connection on your old beacon server still exists and is being merged with your new inventory.
If you navigate to Data Collection->IT Assets Inventory Tasks->Data Imports, and then click on the Inventory Data tab, do you see 2 connections for Altiris?
If you click on the connection name, you can see the last time that inventory was run.
@cartejam - If you look at your screen shot, there is a Delete Connection link. Clicking on this link will then delete all of the raw inventory that was received from your old Altiris connection. Setting this to "Disabled" does not remove the data. Keep in mind that this process could take some time to run.
You should also go back to your old beacon, and go the Inventory Connections and "Delete" the connection from there as well.
So i removed the second Altiris from the old beacon and deleted the connection
I have also configured some of the Java apps so i can review in the Application transparency report
But in the evidence on server i'm looking at Flexera agent does not appear to report what altiris agent finds on this server, which i just do not understand why the flexera agent does not find the same??
I would go back to your Altiris Administrator and see if they can tell you where it is finding those EXE files, especially if the Flexera Agent isn't finding them. Altiris could be pulling these from the Windows Recycle Bin, from a mapped network drive, from the Windows folder, etc.
Since the Flexera Agent is not finding these EXE Files, I would have a Server Admin go to the actual server and verify if they are there or not. It is difficult to troubleshoot the Altiris data because the File Evidence view does not show the Raw File Path. They may be caused by the Flexera Altiris Inventory Connector not importing the File Path from Altiris.