Troubleshooting the discovery by disconnected scanner

Available from 9.2.7. The troubleshooting section lists the most common issues you might encounter while discovering software and hardware inventory with the disconnected scanner. The main objective of troubleshooting is to determine why something does not work as expected and explain how to resolve the problem.

Log files

Scanner log files are in the following directory:

UNIX Installation directory/logs

Windows Installation directory\logs

Optimizing the processor utilization

By default, processor utilization is not limited during the scan. You can optimize it by setting up the CPU threshold. Setting the threshold might lengthen the time of the scan.
Note: Setting the threshold does not guarantee that the CPU consumption is always below the specified value. It fluctuates around that value, sometimes exceeding it and sometimes dropping below it. Temporary peaks are expected. Setting the threshold might lengthen the time of the scan.
  1. Edit the configuration file or files that you downloaded with the scanner: sw_config.xml, fs_config.xml, isotag_config.xml.
  2. Add new cpuThreshold attributes in the appropriate file.
    • For FSScanner add a corresponding parameter in the following files: sw_config.xml, fs_config.xml, isotag_config.xml
    • For Signatures add a corresponding parameter in the sw_config.xml file.
    For example:
    • sw_config.xml
      <CIT>
<XSE version="1.0">
<Plugins>
<Plugin name="FSScanner">
(...)
<Attribute name="cpuThreshold" value="20:2:150:850"/>
<Attribute name="maxQueryTime" value="43200"/>
<Attribute name="interruptOnTimeout" value="true"/>
<Attribute name="assumeAutoFS" value="remote"/>
(...)
</Plugin>
</Plugins>
<Signatures>
<Attribute name="cpuThreshold" value="20:2:150:850"/>
(...)
</Signatures>
</XSE>
</CIT>
</IBM>
    • fs_config.xml or isotag_config.xml
      <IBM>
<CIT>
<FSScan version="1.0">
(...)
<Provider value="provider_cache"/>
<AssumeAutoFS value="remote"/>
<CpuThreshold value="20:2:150:850"/>
</FSScan>
</CIT>
</IBM>
  3. Specify one of the following values:
    Desired utilization Value
    5% 10:2:50:950
    10% 20:2:100:900
    15% 20:2:150:850
    20% 30:2:200:800
    25% 30:2:250:750
    50% 50:2:300:500
  4. Save the file.

Excluding directories from being scanned

You can exclude directories from being scanned. To do this, edit all configurations files: sw_config.xml, fs_config.xml, isotag_config.xml, and specify the directories as values of the excludeDirectory attributes.

  • To exclude the /tmp directory:
    • in sw_config.xml: <Attribute name="excludeDirectory" value="/tmp/"/>
    • in fs_config.xml and isotag_config.xml: <ExcludeDirectory value="/tmp/">
  • To exclude all directories named tmp, for example /tmp and /dir/tmp:
    • in sw_config.xml: <Attribute name="excludeDirectory" value="*/tmp/"/>
    • in fs_config.xml and isotag_config.xml: <ExcludeDirectory value="*/tmp/">

Common problems

The package is being skipped during the import despite meeting the requirements
Such a problem might occur if you are importing more than one package from an endpoint. BigFix Inventory always imports the latest package and omits all previous ones. The following message about skipping the package is related to irrelevant packages and can be ignored: 
2015-11-05 09:35:22 WARN: Skipping file: package_scan.xml from: 201510101200-2inarow.zip. 
The data was already processed.
2015-11-05 09:35:22 INFO: Skipping file: package_scan.xml. 
Unsupported file in: 201510101200-2inarow.zip.
The detected software is duplicated in BigFix Inventory after reinstalling disconnected scanner
If you uninstall the disconnected scanner and remove its directory from a computer, and then reinstall the disconnected scanner, the endpoint ID of this computer is changed. As a result, the software inventory is duplicated in BigFix Inventory. To avoid duplication after you reinstall the disconnected scanner, perform the following actions.
  1. Go to config directory, and substitute the endpoint_id.txt file with the backup file you created before uninstallation. For more information, see: Uninstalling the disconnected scanner. Changing the endpoint ID allows you to keep the historical data, and collect the new data for this endpoint.
  2. Check the DNS and IP address of the endpoint.
  3. Log in to BigFix Inventory.
  4. Navigate to Reports > Computers.
  5. To identify the duplicated computer, add the following columns to the report DNS Name, IP Address and Computer First Seen.
  6. Compare the two computers with the same DNS Name and IP Address, and find the one that was first seen more recently.
  7. Decommission this computer. For more information, see: Decommissioning computers with disconnected scanners.
  8. Wait for the scheduled import or run it manually.
The host name of an endpoint provided by the disconnected scanner is different than expected
The host name that is provided by the disconnected scanner and a regular scanner can be different. The regular scanner uses the host name that is provided by BigFix, while the disconnected scanner checks the host name by running the hostname command, or, if not available, through the scanner check.
Installation of the scanner and the capacity scan are slow on AIX
It happens when the host name cannot be resolved. To solve the problem, add the host name to DNS or to the /etc/hosts file. The default configuration of the name resolver on AIX first looks for the host name in the DNS then in the /etc/hosts file. If you add the host name to the hosts file, you might also need to make changes in the /etc/netsvc.conf file and restart the system.

Monitoring the import log

When you import a package with scan results to BigFix Inventory, the import log (Management > Data Imports) displays information and warning messages related to your package. If the package or its content does not meet the requirements, it might be skipped during the import, and the scan results will not be displayed in BigFix Inventory. While monitoring the import log, you can expect the following messages:
info: Processing scan package: package from: directory.
info: Invalid file name. The scan package must match the pattern YYYYMMDDHHMM-*.zip. Skipping package: package.
info: Invalid Catalog Version property in the computer.yml file: version. The property must match the pattern <Number>.<Number>. The catalog might be reported as outdated.
warn: The disconnected scans location does not exist: directory.
warn: Invalid file name. The scan date must be later than year 2000. Skipping package: package.
warn: Skipping corrupted scan package: package. The following error occurred: error.
warn: Missing computer.yml file. Skipping package: package.
warn: Missing property: property in the computer.yml file. Skipping package: package.
warn: Invalid computer.yml file. Skipping package: package. The following error occurred: error.
warn: The value of the endpointID property in the computer.yml file is longer than 512 characters. Skipping package: package.
warn: The value of the endpointID property in the computer.yml file is empty. Skipping package: package.
warn: Missing property: endpointID in the computer.yml file. Skipping package: package.
warn: Importing older scan package from: date for computer: computer_id. This computer already has data from: date.
warn: The file is larger than 2097150 bytes. Skipping file: scan_file from: package for computer: computer_id.
warn: The following error occurred when processing the package_scan.xml file: error.
warn: The insertion of the operating_system package data into the database failed on record content. The following error occurred: error.