Contents

1E Inventory Product Pack

Classic Product Pack used to create the 1E Inventory instruction set required by the Tachyon Powered Inventory feature.

For more details please refer to Tachyon connector.

Instruction text (ReadablePayload)TypeDescriptionData to Sync categoryInstruction file nameVersion

Which processors are in the device? With a stagger of <limitSecs> seconds.

Question

Processor details

Uses  Device.GetProcessors  method.

 Click here to expand details of data collected...


Method

GetProcessors

ModuleDevice
LibraryCore
Action

Retrieves information about the CPUs plugged in to the motherboard of the device.

Parameters(None)
Return values

Vendor (string): The vendor of the processor

Name (string): The vendor-defined name of this processor package

CoreCount (int): The number of cores inside this package

SpeedMhz (int): The clock speed of the processor in its current operating mode

From v5.1 onwards these columns also appear :

LogicalCoreCount (int) : The number of logical cores inside this package

Hyperthreading (bool): Indicates whether the cores are hyperthreaded, true for yes, false for no.

Example
 Device.GetProcessors();
Platforms
  • Windows
  • Linux
  • MacOS
  • Solaris Intel
  • Solaris Sparc
Notes

Name is the immutable string that the CPU reports to SMBIOS. This often contains the publicly marketed and sold average speed of the CPU, which usually differs to the actual speed of the processor instance.

SpeedMhz on Windows can change over time for one particular CPU. Modern CPU's can adjust their clock in response to heat and power from moment to moment. This parameter cannot be relied upon for scoping future instruction executions unless some kind of range of values is in the scope to cope with natural speed variance.

Processor
1E-Inventory-Device-GetProcessors
3

Inventory - what is the summary of file usage since <startDate>? With a stagger of <limitSecs> seconds.

Question

Process Usage data inventory for SLA

Uses the  $ProcessUsage_Daily inventory table, if Module.Inventory.ProcessUsage.Enabled setting is true (default) in the 1E Client configuration file.

Please refer to 1E Client 5.2 - Tachyon client settings: Capture source settings.

 Click here to expand details of data collected...

Windows only. The following table shows fields available in the $ProcessUsage_Daily table.

FieldDatatypeDescriptionSample valueTables
CommandLinestringThis is a single instance of the command used to launch that instance, most probably the first one. It will not contain any differences if other instances are launched with a slightly different comand line. It is an indication of a typical command line for this instance.C:\Program Files\Git\mingw64\libexec\git-core\git-credential-manager.exe
DurationintegerThe number of minutes covered by the individual execution(s) of at least one instance of this executable.
Duration can never be more than 1440 minutes, being the number of minutes in a day.		1
ExecutableHashstringThe MD5 hash of the binary that contains the entry point (usually an exe)ad3ec70ae9e82582bdf6aa6fd5811376
ExecutableNamestringThe name of the binary that contains the entry point obtained from stamped version information where possible, the filename if not.git-credential-manager.exe
ExecutableSizeintegerThe size of the binary that is hashed below 131168
ExecutableVersionstringThe version information stamped into the executable where available.1.5.0.0
ExecutionCountintegerThe number of instances observed during the Duration period2
IsOSProcessinteger

A value of 1 indicates that this is categorised as an operating system by the rules in place.

A value of 0 indicates that it is not.

0
LastSeeninteger

The UTC Timestamp of when the last instance of the executable (of all the accumulated subjects of this record) was last seen (polling) or actually exited (events).

Whilst any instance is running, for the current day records, LastSeen will creep across the day and duration will increase as time passes if the process remains running.

Once midnight is crossed then the daily records for yesterday are 'closed off' by setting LastSeen = TS + 86400 (the number of seconds in a day), which is midnight of the next day.

If all instances of one binary are exited and never run again that day, then the LastSeen field for that daily record should 'stick' at one value and never ever change again.

In other words the maximum difference between TS and LastSeen in a single row is at most 86400, being the number of seconds in a day.

Tracking of an execution summary from one day to another ("carry-over") can be achieved by looking for a record based on TStomorrow = LastSeentoday with all the other key information the same. If that exact key record with the 'carry over' conditions is not found then the process did not theoretically continue across midnight.

Note that a process that dies after 23:59:00 and starts before 00:01:00 the next day will appear to be a continuous process in the summary tables. Even though it could theoretically have stopped for nearly two minutes. This is because the resolution of the table is to the start of the minute the event occurred in.

1526982245
TSinteger

When the record was added to the table. See Timestamps.

Midnight UTC that is the start day of the 24 hours covered by this record.

1526947200

The Tachyon client captures executable usage; this is from the moment the executable is turned into a process, hence the process usage. The Process Usage data presented is grouped by executable binary, and parallel runs are accumulated in the ExecutionCount, but not in the Duration, where coverage time period is desired instead.

Software Usage
1E-Inventory-FileUsageSummary
3

Inventory - what software is installed? With a stagger of <limitSecs> seconds.

Question

Software inventory for SLA

Uses a combination of:

 Click here to expand details of data collected...


Method

GetInstallations

ModuleSoftware
LibraryCore
Action

Gets a list of the installed software available to all users, optionally filtered by product and/or publisher.

Parameters

Product (string; optional): If specified, search for just this product.

Publisher (string; optional): If specified, get just this publisher's software.

Return values

A table of:

    • Product (string): The product name.
    • Publisher (string): The publisher of the product.
    • Version (string): The version of the product.
    • InstallDate (string): If available, when the product was installed.
    • Architecture (string): Platform architecture of this installation (e.g. x86, x64)
Example

Get all software:

 Software.GetInstallations();

Find and remove all installed instances of Calculator Plus:

Software.GetInstallations( Publisher : "Microsoft", Product : "Microsoft Calculator Plus");
evaluate;
Agent.Echo( Message: "Is installed");
Software.Uninstall( Publisher : "Microsoft", Product : "Microsoft Calculator Plus");

To select a specific version, use a SQL WHERE clause:

@installs = Software.GetInstallations( Publisher : "Microsoft", Product : "Office Professional");
SELECT DISTINCT * FROM @installs WHERE Version LIKE "16.0%";
Platforms
  • Windows
  • Linux
  • MacOS
  • Solaris Intel
  • Solaris Sparc
  • Android
Notes

To find additional software installed for specific users, use Software.GetUserInstallations.


Method

GetUserInstallations

ModuleSoftware
LibraryCore
Action

Gets a list of the software installed for specific users, optionally filtered by product and/or publisher.

Parameters

Product (string; optional): If specified, search for just this product.

Publisher (string; optional): If specified, get just this publisher's software.

Return values

A table of:

    • Architecture (string): Platform architecture of this installation (e.g. x86, x64)
    • InstallDate (string): If available, when the product was installed.
    • Product (string): The product name.
    • Publisher (string): The publisher of the product.
    • Sid (string): The user identifier for whom this software has been installed.
    • Username (string): Friendly representation of the Sid - this will only be resolved locally.
    • Version (string): The version of the product.
Example

Get all user specific software:

 Software.GetUserInstallations();
Platforms
  • Windows
Notes
  • Sid resolution may fail as this method will not go over the wire. In this case Username will be NULL.

  • The file modified and accessed time attributes of the NTUSER.dat directory entries under the %USERPROFILE% folder for each user and service principal might be updated to some time during the execution of this method. This is a side effect of loading and unloading the user hive and is housekeeping performed by Windows, not the 1E Client. This can cause "unused" profiles to appear to be used if the modified times are employed to determine whether a user has logged in, which is not a reliable method of establishing this fact.

  • This method reads user uninstall registry keys from HKU, but will not load hives.
  • Installs for this function are retrieved from HKU:\<SID>\Software\Microsoft\Windows\CurrentVersion\Uninstall

Installed Software
1E-Inventory-Software
3

Inventory - summary of which users have logged on since <startDate>? With a stagger of <limitSecs> seconds.

Question

User data inventory for SLA

Uses the  $UserUsage_Daily  inventory table, if Module.Inventory.UserUsage.Enabled  setting is true (default) in the 1E Client configuration file. Top Console User is also calculated from this table.

Please refer to 1E Client 5.2 - Tachyon client settings: Capture source settings.

 Click here to expand details of data collected...

Windows only. The following table shows fields available in the $UserUsage_Daily table. 

FieldDatatypeDescriptionSample valueTables
Durationinteger

The number of minutes covered by the individual user session(s) of at least one instance of this login.

Duration can never be more than 1440 minutes, being the number of minutes in a day.

12
  •  $UserUsage_Daily
EmailstringThe email address that is cached in the system for this user. This may not necessarily be the email address to use to contact the user via corporate email.abrown@acme.org
  •  $UserUsage_Daily
FirstNamestringThe forename that the system has cached for the user.Alice
  •  $UserUsage_Daily
LastNamestringThe surname that the system has cached for the userBrown
  •  $UserUsage_Daily
LastSeeninteger

The UTC Timestamp of when the last instance of the user session (of all the accumulated subjects of this record) was last seen (polling) or actually exited (events), rounded down to the start of the minute in which the event occurred.

Whilst any session is in progress, for the current day records, LastSeen will creep across the day and the duration will increase as time passes if the user remains logged in. That is Duration and LastSeen will increase each time you query the table (with at least a minute between queries).

Once midnight is crossed then the daily records for yesterday are 'closed off' by setting LastSeen = TS + 86400 (the number of seconds in a day), which is midnight of the next day.

If all users sessions for one user are exited and never occur again that day, then the LastSeen field for that daily record should 'stick' at one value and never ever change again.

In other words the maximum difference between TS and LastSeen in a single row is at most 86400, being the number of seconds in a day.

Tracking of a user session summary from one day to another ("carry-over") can be achieved by looking for a record based on TStomorrow = LastSeentoday with all the other key information the same. If that exact key record with the 'carry over' conditions is not found then the user session did not theoretically continue across midnight.

Note that a session that exits after 23:59:00 and starts again before 00:01:00 the next day will appear to be a continuous user session in the summary tables. Even though it could theoretically have not existed for nearly two minutes. This is because the resolution of the table is to the start of the minute the event occurred in.

See Timestamps.

1526990846
  •  $UserUsage_Daily
SIDstringThe Windows NT SID of the user.S-1-5-21-xxx-yyy-zzz
  •  $UserUsage_Daily
TSintegerWhen the record was added to the table. See Timestamps.1526947200
  •  $UserUsage_Daily
Usernamestring

The user account name, with a domain prefix if applicable.

For Windows devices not a in a domain, the 'domain' is the local machine name. For non-Windows devices such as Linux there is no domain part.

aliceb

acme\AliceBrown

  •  $UserUsage_Daily

The Tachyon client captures user sessions (usage); this is from the moment the user instigates a login/logout, hence User Usage. The usage data presented is grouped by SID and Username, and parallel login durations are really the coverage of the time period, not the total time for all the individual sessions.

User and administrator accounts are included, either local or remote. System accounts, and accounts used to run services, are excluded. 

User
1E-Inventory-UserUsageSummary
3

Returns patch status for 1E Inventory consumption, staggering for <limitSecs> seconds.

The 1E-PatchSuccess-PatchStatus instruction is not required if you do not intend using the Patch Success application, and will not run if you do not have a license for Patch Success. For more information about configuring Patch Success please refer to Configuring Patch Success.

This instruction is part of this 1E Inventory instruction set used by the Tachyon Connector. Do not move it to the 1E Patch Success instruction set used by the buttons visible in the Patch Success application.

QuestionReturns patch status for 1E Inventory consumption

Patch

1E-PatchSuccess-PatchStatus
5.0