Types of software scans

In this type of scan, the BigFix server creates scanner catalogs that are sent to the endpoints. Based on those catalogs, the scanner discovers exact matches and sends its findings to the server. Scanner catalogs do not include signatures that can be found based on the list of file extensions nor entries that are irrelevant for a particular operating system.

In this type of scan, the scanner uses a list of file extensions to check whether any files with those extensions exist on the endpoints. Then, it returns the findings to the BigFix server where the discovered files are compared with the software catalog. If a particular file matches an entry in the catalog, the software is discovered.

The complete file extensions list is stored in the file_names_all.txt, file_names_unix.txt, and file_names_win.txt files located in the BigFix Inventory server configuration directory. Both catalog-based scanning and file system scanning work together as complementary methods. Some signatures are catalog-based, some are package-based, and some require file facts to work. There are also signatures that combine file facts with the package data. Catalog-based signatures work independently and can look up files on their own.

Collecting executable files based on application usage

Starting from application update 9.2.8, the file system scan additionally reports files that are based on processes that have been run on the computers in your infrastructure, regardless of their extension. To view these files, you need to meet the following criteria:

• The BigFix server and client are in version 9.5.5 or higher.
• The operating system is Linux or Solaris.
• Application Usage Statistics analysis is activated.

The reported files, with supplementing information such as path and size, are available on the Scanned File Data report and can be used to create custom discovery and use signatures for software components. If the process has been active at least once since the feature was turned on and the associated file exists on the computer, this file is displayed on the report.

This feature is enabled by default. To stop collecting information about the files, run the Disable Collecting Executable Files Based on Application Usage fixlet. In case you need to reactivate this feature, run the Enable Collecting Executable Files Based on Application Usage fixlet.

Outputs of the file system scan

The scan generates a full file system scan. The full file system scan includes information about all files that were discovered on the endpoint. The output is generated during every scan and uploaded to the BigFix server.

In this type of scan, the scanner searches for software identification tags that are delivered with software products. Then, it returns the findings to the BigFix server where the tags are processed. Based on the information that they contain, the software is discovered.

In this type of scan, the scanner gathers information about processes that are running on the endpoints. Then, it returns the findings to the BigFix server where the data is translated into usage statistics.

The usage data is first collected when the BigFix client is installed on an endpoint, and an application usage statistics is enabled. The statistics are displayed on the Metering Data report. When the processes are matched against usage signatures from the software catalog, or custom usage signatures, the statistics are available on the Software Classification panel.

Starting from application update 9.2.11, BigFix Inventory additionally collects application usage data in a new format.

The scanner script can be used for Linux package as well. The script checks only two package managers: RPM-based systems: Uses rpm -qa command and Debian-based systems: Uses dpkg-query -W command. The scanner does not access other package managers like YUM, APT, and Zypper, etc. It only uses the core RPM and DPKG APIs.