Oracle Java file evidence - not sure if it is accurate

[cartejam]

Hi

I'm running through some reports following a clean-up of Oracle Java, i noticed a device evidences showin two differing results from agents Altiris and Flexera, which are installed on this server.

The Java was removed, but the Evidence still showing, is this meant to clean-up after the removal??

[Flex-Jeremy]

HI @cartejam, 

Looking at the screenshot that you have provided, the evidence coming from Flexnet Manager Suite is most likely stale, given the last inventory date that is shown in the screenshot. To remedy this, I would recommend running a new scan with your  Flexnet Manager Suite inventory source on this machine. 

As for the evidence from Altiris, this evidence is an Uninstall registry key. This was most likely missed by the uninstaller when the Java application was uninstalled. You (or your IT team)can remove this Uninstall evidence from the registry manually. 
You can find more information, and the location of this registry key in the knowledge base article below: 

What is "Uninstall" evidence?
https://community.flexera.com/t5/FlexNet-Manager-Knowledge-Base/What-is-quot-Uninstall-quot-evidence/ta-p/6040 

[cartejam]

Hi Jeremy,

Thank you for the response, and sorry I forgot to mention the following:-

There are two agents both reporting the server Altiris is running weekly, flexera agent set to run daily, see screen capture of setting

The server last updated on 20/3/2022 by Altiris

[kclausen]

@cartejam - If you go back and look at your original image that you provided that is showing the raw evidence being picked up, they are showing very old "Last Inventory Dates".  This implies that something has happened where both the Flexera Agent and the Altiris Agent are not reporting in current inventory for this specific server.

The Flexera Agent shows a last inventory date of October of 2021.
The Altiris Agent shows a last inventory date of January of 2022.

[cartejam]

Hi Kirk,

Correct the dates are older for the evidence inventory than the agent inventory, so that is why i'm baffled here.

I even deleted the record in flexera, for one server for it to re-create, hoping it would not bring in this old evidence, it still did, it recreated the server and the old evidence with those dates!

I'm concerned that something is not right with the reconcile, but where do i start to look???

[nrousseau1]

Hello @cartejam ,

Are you saying Altiris provides a refreshed view and not FNMS? You still see a Java.exe evidence?

Are you seeing in the evidence tab an inventory date that is recent too? Or maybe two inventory dates?

You can use the "Application Transparency" report released earlier this week... actually, it will show all the details on Java next week if you are in the US Cloud (or it has already the data if you are in EMEA).

Thanks,

Nicolas

[ChrisG]

A couple of likely causes to consider here are:

• Have you somehow ended up with multiple raw computer records (including one old/out of date record) with FlexNet inventory agent data? A good way to check that is to look up the computer in the Inventory Device Matching page in the UI to see what raw computer records have been merged into the one inventory device record you see.
• Has the FlexNet agent actually recently uploaded fresh inventory? Details on the Inventory Device Matching page will likely give some insight here, but you could also check the agent logs (particularly C:\Windows\Temp\ManageSoft\tracker.log) on the client computer itself to verify activity.

[cartejam]

Hi Chris,

So i think you are on to something here, in the device match i see this, which makes me think something is not right.

I do remember one thing, i moved the altiris invenory to my other beacon, not sure exactly when, this is as i will be decommissioning the on prem beacon

Please can you tell me what i need to do to fix this, if this is an issue i have found

[kclausen]

It sounds like all of your old inventory data from your prior Altiris connection on your old beacon server still exists and is being merged with your new inventory.

If you navigate to Data Collection->IT Assets Inventory Tasks->Data Imports, and then click on the Inventory Data tab, do you see 2 connections for Altiris?

If you click on the connection name, you can see the last time that inventory was run.

[cartejam]

Hi Kirk,

Seems you are spot on there, here is screen shot, two Altiris!!

I should of disabled the one from On-prem beacon i think

circled is the new beacon

[kclausen]

@cartejam - If you look at your screen shot, there is a Delete Connection link.  Clicking on this link will then delete all of the raw inventory that was received from your old Altiris connection.  Setting this to "Disabled" does not remove the data.  Keep in mind that this process could take some time to run.

You should also go back to your old beacon, and go the Inventory Connections and "Delete" the connection from there as well.

[cartejam]

Hi Kirk,

So i removed the second Altiris from the old beacon and deleted the connection

I have also configured some of the Java apps so i can review in the Application transparency report

But in the evidence on server i'm looking at Flexera agent does not appear to report what altiris agent finds on this server, which i just do not understand why the flexera agent does not find the same??

[kclausen]

Are you sure that the Flexera Agent is installed on this server?  

[cartejam]

Absolutely sure it has both flexera and altiris agent

[kclausen]

@cartejam - When you look at the Evidence tab for JAVA, what is the Last Inventory Date that you see for Altiris and for Flexera?

[cartejam]

Hi Kirk,

Please see Evidence - Installer, File, WMI attached

[kclausen]

I would go back to your Altiris Administrator and see if they can tell you where it is finding those EXE files, especially if the Flexera Agent isn't finding them.  Altiris could be pulling these from the Windows Recycle Bin, from a mapped network drive, from the Windows folder, etc.   

[cartejam]

Hi Kirk,

So these files are not in recycle bin, or mapped drives, these files exist in standard windows folders like

c:\Program Files\Java\jdk1.8.0_221\bin

[kclausen]

If you remove your filters on the Installer Evidence/File Evidence tabs, do you see any current inventory being received from the Flexera Agent?

[cartejam]

Hi Kirk,

Please see attached, screen shots of data coming from both inventory source

[kclausen]

Since the Flexera Agent is not finding these EXE Files, I would have a Server Admin go to the actual server and verify if they are there or not.  It is difficult to troubleshoot the Altiris data because the File Evidence view does not show the Raw File Path.  They may be caused by the Flexera Altiris Inventory Connector not importing the File Path from Altiris.