HCL Software Academy HCL-BF-PRO-10 - HCLSoftware U Certified Professional-BigFix Platform 1

Baselines are collections of Fixlet messages and Tasks that can be deployed to a group of endpoints with a single command.

Baseline components are pointers to their corresponding source Fixlets or Tasks, which means that they do not contain the actual content, but only reference the original source.

Baseline components can get out of synchronization with their source Fixlets or Tasks, which means that the source content may change or become obsolete, while the Baseline component remains unchanged. This can cause issues such as incorrect relevance, missing downloads, or failed actions.

To avoid these issues, Baseline components should be synchronized with their source Fixlets or Tasks regularly, either manually or automatically. Synchronization updates the Baseline components with the latest content from the source Fixlets or Tasks, and also removes any components that are no longer available or relevant.

Baselines can be created by any user who has the permission to create content in a custom site. This includes Master Operators, who have full permissions to manage all aspects of the BigFix environment, as well as Non-Master Operators, who have limited permissions to manage specific sites or domains.

Baselines can include more than 100 components, but this is not recommended for performance and usability reasons. The optimal number of components for a Baseline depends on various factors, such as the size of the deployment, the complexity of the content, the frequency of the updates, and the network bandwidth. Generally, it is advisable to keep the Baseline components as few and simple as possible, and to group them logically by function or category.

Baselines can include other Baselines as components, which allows for creating nested or hierarchical Baselines. This can be useful for organizing and managing complex or large-scale deployments, such as patching multiple operating systems or applications. However, nesting Baselines also adds more layers of complexity and potentialsynchronization issues, so it should be done with caution and proper planning. References:

Introducing Baselines

Creating or Customizing Baselines

Baselines

To create a Custom Site, you need to select Tools > Create Custom Site from the BigFix Console and enter a name for your site. You can also provide a description and a domain for your site.

To assign permission levels to operators, you need to click the Operator Permissions tab from the site dialog and select the operators from the list. You can also grant read permission globally to all operators by clicking the corresponding button.

The permission levels that can be assigned to operators are:

Reader: This level allows the operator to view the content of the site, but not to modify it or create new content. Readers can also subscribe computers to the site, but not change the subscription criteria.

Writer: This level allows the operator to view and modify the content of the site, as well as create new content. Writers can also subscribe computers to the site and change the subscription criteria.

Owner: This level allows the operator to view, modify, and create content, as well as manage the site settings, such as the name, description, domain, and operator permissions. Owners can also subscribe computers to the site and change the subscription criteria.

The permission levels that cannot be assigned to operators are:

User: This level is not applicable to Custom Sites, as it is only used for External Sites to indicate that the operator has accepted the license agreement for the site.

Administrator: This level is not applicable to Custom Sites, as it is only used for the Master Action Site to indicate that the operator has full control over the site and can perform any action on any computer.

Guest: This level is not applicable to Custom Sites, as it is only used for the BES Support Site to indicate that the operator has read-only access to the site and cannot subscribe computers to the site. References:

Creating Custom Sites

User Permissions and Guidelines

Selecting Sites

Launch the BigFix Administration Tool from the Start menu or from the installation folder.

Enter the current password for the Site Administrator private key and click OK.

Click the Advanced Options tab and select Change Site Administrator Private Key Password.

Enter the new password, confirm it, and click OK.

Restart the BigFix Server service for the changes to take effect. References:

Re-creating Site Credentials

Change Private Key Password

Need help in to recover or set a new password for the Bigfix Admin

To upgrade the BigFix platform components, you need to follow the recommended order and the version rules as documented in the Upgrade Paths and the BigFix Upgrade Best Practices.

The recommended order of upgrading the components is as follows:1

The BigFix servers and consoles. These components must match their versions and must be upgraded at the same time (consoles with a version earlier than or later than the server version are not allowed to connect to the server and database).

The BigFix relays

The BigFix agents

The version rules for the components are as follows:12

server version >= relay version >= client version

This means that the server version must be equal to or higher than the relay version, and the relay version must be equal to or higher than the client version.

This ensures that the components are compatible and can communicate with each other without any issues.

For example, if the server version is 10.0.2, the relay version can be 10.0.2, 10.0.1, or 10.0.0, and the client version can be 10.0.2, 10.0.1, 10.0.0, or any lower version.

References:

1: Upgrade paths for BigFix 10 - HCL Product Documentation

2: Upgrading on Windows systems - HCL Product Documentation

3: BigFix Wiki - BigFix Upgrade Best Practices

The Four Eyes Approval feature is a security mechanism that requires the approval of another console operator who is a member of a specified role before an action can be executed. This feature is useful for preventing unauthorized or accidental actions that could affect the endpoints in the BigFix deployment. To enable this feature, you need to follow these steps:

Use the BigFix Administration Tool to add the useFourEyesAuthentication advanced option and set its value to true.

Restart the BES Root Server service and the BigFix Console.

Create a role for the approvers and add one or more operators to it.

Select the Actions Require Approval option for the operators who need to get approval for their actions and choose the approvers role from the drop-down list.

When an operator takes an action that requires approval, they will see a dialog box asking them to enter the credentials of an approver. The action will be pending until an approver logs in and approves it. References:

Four Eyes Approval Capability

Has anyone tried SAML Authentication with Four-Eyes authentication?

BigFix Platform Security Configuration Guide

To create a new retrieved property in BigFix, the following steps are required:

From the BigFix Console, select Manage Properties from the Tools menu. The Manage Properties dialog is displayed.

You can filter the properties by using the left filter panel to select a subset of the properties to view on the right. If you cannot find what you want in this list, create a new property: click Add New, then enter a name for the property and a valid Relevance expression. This can access hardware characteristics, registry entries, and even data in specific files on the client computers.

After you define the new property, the Clients automatically compute the value of the corresponding relevance expression and return it to the Database. Click the OK button.

The new property will be available in the column headers of computer listings, allowing you to sort and filter on its values. It can also be used to target Fixlet actions and generate Web Reports.

References:

Creating Retrieved Properties

Adding new properties under “By retrieved properties”

The download cache size on a relay or a server can be changed by using the Fixlet ID# 148 BES Relay/Server Setting: Download Cache Size, available from the BES Support Site.

This Fixlet allows the administrator to specify the desired cache size in MB as a parameter of the action.

To increase the cache size to 10 GB, the administrator needs to enter 10240 as the value of the parameter, since 1 GB = 1024 MB.

The Fixlet will then create or modify the client setting _BESGather_Download_CacheLimitMB on the target relay or server, and set its value to the specified parameter.

The Fixlet will also restart the BES Client service on the target relay or server to apply the new setting.

The new cache size will take effect after the service restarts, and the relay or server will be able to store more downloaded files in its cache. References:

Managing Downloads

BES Client download cache limit?

The download size exceeds the maximum value set in the client setting

The BigFix Diagnostics Tool is a program that checks the status and configuration of the server components, such as the database, the gather service, and the web reports server.

The tool can be run at any time, either after installing the server or later, to troubleshoot any issues or monitor the server performance.

To run the tool, you need to log on to the server as an administrator and launch the program from the Start menu.

The tool will analyze the server components and display the results in a graphical interface, with green, yellow, or red lights indicating the health of each component.

You can also click on the Full Interface button to see more details and access the knowledge base articles for each component.

The tool can also be run remotely by taking action on the Troubleshoot: Execute Server Diagnostic task located in the BES Support site, but this requires the client to be installed on the server. References:

Running the BigFix Diagnostics tool

Running the IBM BigFix Diagnostics tool

Waiting for downloads to be mirrored - BigFix Forum

BigFix Wiki - BES Client Diagnostics

A Manual Computer Group is a group that is defined by manually selecting the computers from the Computers List Panel1. A Manual Group can only be shared between Master Operators2.

An Automatic Computer Group is a group that is defined by using Relevance expressions or properties to indicate the group membership3. An Automatic Group can change its population dynamically depending on the evaluation of the group properties3.

An operator might create a Manual Computer Group instead of an Automatic Computer Group if they need to base the group membership on information that is not available using Relevance expressions or properties. For example, if the operator wants to group computers based on their physical location, owner, or usage, they might not be able to use Relevance expressions or properties to determine that information. In that case, they can manually select the computers that belong to the group4.

However, Manual Groups have some drawbacks, such as being static, not scalable, and not extensible5. Therefore, it is recommended to use Automatic Groups whenever possible and use Manual Groups sparingly25. References:

Manual Computer Groups - HCL Product Documentation

Manual Groups vs Automatic - Platform - BigFix Forum

Creating Automatic Computer Groups - HCL Product Documentation

Task or Fixlet to move computers into manual group - BigFix Forum

Regarding Manual Computer Groups - BigFix Forum