Troubleshooting usage monitoring

This section provides information troubleshooting issues with missing or incomplete usage monitoring data.

When usage monitoring data is missing, incomplete, outdated or the 'Usage Monitoring Healthy' column in the 'Computers' report shows 'No', the following activities can be performed to identifiy and fix the source of the issue:

BigFix Inventory 11.0.5 and lower

  • Ensure the 'Application Usage Statistics' analysis is activated.
  • Ensure the 'Initiate Software Scan' has been started with the 'Application usage statistics' property enabled. Ensure the fixlet is running on all computers for which the usage monitoring data should be collected.

BigFix Inventory 11.0.6 and later

  • Ensure that the fixlet “WARNING: BES Client has not activated Application Usage Statistics Collection” is not relevant for computers expected to report usage statistics. If it is relevant, use this fixlet to enable the collection of Application Usage Statistics required for BigFix Inventory Software Usage reporting.
  • Verify that the Initiate Software Scan action is scheduled. To optimize scan duration, deselect the option "Application Usage Backward Compatibility for BigFix Inventory 11.0.5 or lower”.

Steps common to all versions

  • Check if the 'Initiate Software Scan ' and 'Upload Software Scan Results' fixlets are successfully running according to scheduled frequency. To check detailed status of the scans use 'Software Scan Status' analysis.
  • Check if the latest data import was successful and does not contain errors or warnings related to software scan and usage monitoring.
  • Ensure the datasource of the computer is not dissonnected type, as usage data is not collected for such computers.
  • In the 'Software Installations' report ensure the software instance has been discovered on the computer.
  • In the 'Metering Data' report check if the process of a software instance is present. If it is missing, it means the application was not running or the usage monitoring data was not properly collected or processes. Check if the application is running and if the usage data is still missing, check other steps of this troubleshooting.
  • If the software instance and correspoding process are present in the 'Software Installations' and 'Metering Data' reports, check if the software component signature contains a file discovery rule with file name matching the process name. If there is no matching, the usage data will not be collected. In such case you may consider creating a custom signature with file discovery rule which will match the process name.
Questions and Answers
  • Metering data panel does not show any processes for a computer - verification on endpoint
    1. Check if the Bigfix Inventory fixlet “WARNING: BES Client has not activated Application Usage Statistics Collection“ is relevant for a given computer. If relevant, use the fixlet to enable a collection of Application Usage Statistics
      BigFix Inventory expects following endpoint settings:
       _BESClient_UsageManager_EnableAppUsageSummary set to 1

 _BESClient_UsageManager_EnableAppUsageSummaryPath set to 1

 _BESClient_UsageManager_EnableAppUsageSummaryApps set to -:noapp:
    2. Verify content of the bfi_usage_data file on endpoint side:
      check if a version of the endpoint is higher or equal to 10.0.0

review endpoint logs for errors
      If the file is empty:
      • check if a version of the endpoint is higher or equal to 10.0.0
      • review endpoint logs for errors
     _BESClient_UsageManager_EnableAppUsageSummary set to 1
 _BESClient_UsageManager_EnableAppUsageSummaryPath set to 1
 _BESClient_UsageManager_EnableAppUsageSummaryApps set to -:noapp:
  • What does the "Has Usage?" column mean, and what determines "Yes" or "No?"
    Warning: the column has been deprecated. Please use the 'Usage Actively Monitored' and 'Usage Monitoring Healthy' columns instead, see Report columns
  • What is the difference between blank data and zeros for Total Runs, Average Runs per Day and Total Run Time?
    • Zero (0): We're monitoring the binary but it hasn't run during the monitoring period.
    • Blank: We're not monitoring this component (no usage signature exists).
  • Why do components like "Tar Command" show 5 runs but zero Total Run Time and Average Run Time?
    • The binary runtime was short (in seconds) and rounds to zero. For short-lived processes, existing technology might not be able to detect each and every run. This happens when processes are not cached during sampling of running processes. Currently, the sampling period varies depending on the load on the BigFix Platform Client.
  • <Not applicable from version 11.0.6> Why aren’t we collecting usage data on some components which are being used (e.g. BigFix Platform Agent, Tanium Client, etc.)?
    • These components are detected by SWID tags or other methods, but don't have usage signatures in the catalog that point to specific binary files.
      • Examples:
        • BigFix Platform Agent: Detected but no usage signature defined
        • Tanium Client: Detected but no usage signature defined
        • WebSphere components: Often detected by SWID tags, not binary signatures
  • Why are there cases of a single install with multiple install records (different install paths), where one has usage and the other doesn’t?
    • For signature-based detection (which is per release), each instance will have the same stats assigned. If discovery is based on path (Java-based software detection), then resolution is better and includes path. Java detection works well if the used JRE is within the software's reported installation path. There might be cases when the JRE is located outside of the application - then usage will be reported only for the JRE when detected, but not for the application using it.

      Matching algorithm will not work if:

      • process which runs for given component runs not from the installation directory then component installation path
      • if component does not have installation path and does not have dedicated usage signature
  • Monitoring period = Since activation of usage monitoring
    • Usage data accumulates from when monitoring was first activated.
    • Data resets only when: BigFix Client reinstallation or cleanup of _BESData_Global\UsageData.
    • BigFix Inventory Server doesn't track history, only shows current statistics from BigFix Client.
    • Why you see 2+ year old data: Those clients have been monitoring continuously without reinstallation/cleanup.
    • The first since date is kept as long as component exists in BigFix Inventory
    • Statistics, such as total runs are refreshed each time the data is imported and reflects 30 days history
  • <Not applicable from version 11.0.6>In a similar case for WAS ND, SWID tags are in multiple paths supporting different running apps... how is BFI determining the usage for each app (java processes)?
    • Java detection works by matching the software installation path and the Java process path. If the used JRE is within the software's reported installation path, then there is a match and the software is assumed as Java-based with usage linked accordingly. There might be cases when the JRE is located outside of the application - then usage will be reported only for the JRE when detected, but not for the application using it.
  • Why are we seeing usage on SW with no usage signature? How is that being collected? Note process name show "see details", which shows Java...how does it know when identification is from a SWID tag?
    • BFI uses two matching methods:
      1. Process name matching - matches running process to executable
      2. Java path correlation - if Java runs from the software installation path, usage is attributed to that software
    • Your case:
      • Software detected via SWID tag (no usage signature)
      • Java processes run from the software installation directory
      • BFI attributes Java usage to SWID-detected software
      • Shows as "java" usage entry
    • Bottom line: SWID-detected software shows usage when Java runs from its installation path.
  • BigFix platform is always detected by SWID tag, but we see usage data on some windows installs...how does it know to look for java usage?
    • BigFix Inventory uses simple path matching:
      • If a Java process runs from the software installation directory → usage is attributed to that software.
      • This works even for SWID-detected software (no usage signature needed).
    • Your BigFix Platform Agent case:
      • Detected via SWID tag.
      • Java components run from the BigFix installation path.
      • BFI creates "java" usage entries for the software.
    • Answer: Java path correlation - when Java runs from within the software's installation directory, BFI attributes the usage to that software regardless of the detection method.