HCL-BF-PRO-10 HCLSoftware U Certified Professional-BigFix Platform 1 Questions and Answers

The Site Administrator key is a private key that is used to perform site-level tasks such as setting global system options, editing mastheads, and administering Distributed Server Architecture (DSA) 1 .

The Site Administrator key is generated during the installation of the BigFix Server, when the site administrator is prompted to enter a password to encrypt the key 2 .

The Site Administrator key is stored in a file named  license.pvk  in the  BigFix Enterprise\BES Server  folder on the BigFix Server 3 .

The Site Administrator key is required to run the  BESAdmin.exe  tool, which is used to manage the BigFix Server configuration and settings.

The Site Administrator key is also required to create the masthead file, which is a file that contains the digital signature and configuration information of the BigFix deployment.

The Site Administrator key is different from the Master Operator key, which is used to access the BigFix Console and create other operators.

References:

1 :  The Site Administrator

2 :  Admin site key for installation

3 :  Site administrator responsibilities

: Using the BESAdmin Tool

: Creating the Masthead

: BigFix Site Administrator and Console Operators

Launch the BigFix Administration Tool from the Start menu or from the installation folder.

Enter the current password for the Site Administrator private key and click OK.

Click the Advanced Options tab and select Change Site Administrator Private Key Password.

Enter the new password, confirm it, and click OK.

Restart the BigFix Server service for the changes to take effect.  References:

Re-creating Site Credentials

Change Private Key Password

Need help in to recover or set a new password for the Bigfix Admin

Starting from V9.5.6, the relay diagnostics page is disabled by default and can be protected by a password when enabled.

To enable the relay diagnostics page, you need to set the client setting _BESRelay_Diagnostics_Enable to a value of 1 on the relay computer. You can do this using the BigFix Console, the registry editor, or a custom fixlet or task.

To protect the relay diagnostics page with a password, you need to assign a value to the _BESRelay_Diagnostics_Password client setting on the relay computer. You can do this using the same methods as above.

After setting the _BESRelay_Diagnostics_Password, the URL to the relay diagnostics page must use the https protocol instead of http, otherwise the browser will show the “403 forbidden” error and the relay diagnostics page will not display.

To access the relay diagnostics page, open a browser and type in the address field: https:// < computer_name > :52311/rd or https:// < computer_name > :52311/RelayDiagnostics, where < computer_name > is the address of the workstation where the relay that you want to check is installed. You will be prompted to enter the password that you set for the _BESRelay_Diagnostics_Password client setting.

On the relay diagnostics page, you can gather information about your environment settings, relay status, console user authorization, site gathering, and client registration.  References:

Relay and Server diagnostics

How can I enable _BESRelay_Diagnostics_Enable" = “1”

Relay diagnostics

When creating a scheduled activity in Web Reports, the Activity Actions box allows the user to specify what actions to take when the activity runs 1 .

The available options are:

Email : The user can choose to send the report or alert to one or more recipients via email. The user can also customize the subject line and the message body of the email.  The user can also choose to include the output of the report, a link to the report, or a link to the archive in the email 1 .

Archive : The user can choose to save the report or alert in the Web Reports archive for later viewing or downloading.  The user can also set the limits for the number of archives, the time duration of each archive, the disk space used by each archive, or the number of entries in each archive 1 .

Customized Executable : The user can choose to run a customized executable that is triggered when the activity runs. The executable must be located in the correct directory on the Web Reports server.  The user can also pass some variable information to the executable, such as the activity name, the report file, or the activity creator 1 .

The user can select one or more of these options for each scheduled activity.  For example, the user can email and archive the report, or email and run the executable, or archive and run the executable, or do all three 1 .

References:

1 :  Creating Scheduled Activities

To reconfigure a proxy server on a Windows BigFix Root server, the administrator needs to run the command BESAdmin.exe /setproxy from the BES Server folder with the appropriate parameters 1 .

The command BESAdmin.exe /setproxy allows the administrator to edit the proxy configuration settings after installation by specifying the proxy host, port, user, password, exception list, secure tunneling, authentication methods, and downstream notification 1 .

The command BESAdmin.exe /setproxy can also be used to delete the existing proxy settings by using the /delete parameter 1 .

The command BESAdmin.exe /setproxy is only available on Windows systems.  On Linux systems, the equivalent command is BESAdmin.sh -setproxy 2 .  References:

Setting a proxy connection on the server - HCL Product Documentation

Configuring the proxy - HCL Product Documentation

The BigFix Client contacts its Relay to gather new content using the  UDP  protocol on port 52311 (by default).

The UDP protocol is used for  notifications , which are messages sent by the Relay to inform the Client that there is new content available, such as actions, fixlets, tasks, or analyses.

The Client then initiates a  TCP  connection with the Relay on the same port to  download  the new content and  report  the results back to the Relay.

The TCP protocol is used for  data transfers , which are more reliable and secure than UDP, but also more resource-intensive and slower.

The Relay then forwards the Client reports to the Root Server or another Relay using the TCP protocol as well.  References:

Port requirements for communication between root to clients via relay

BigFix Wiki - BigFix Relays

How is BigFix secure? Authentication or Protocol used in BigFix for secure communication

BigFix Clients are the endpoints that run the BigFix Agent software and communicate with the BigFix Server or Relays.

BigFix Clients periodically check for new content from the BigFix Server or Relays, such as Fixlets, Tasks, Actions, or Analyses.

The default interval for checking new content is 15 minutes, but this can be configured by the BigFix Administrator.

To reduce the network traffic and latency, BigFix also uses a notification mechanism to inform the BigFix Clients of new content as soon as possible.

The notification mechanism uses the UDP protocol, which is a connectionless and lightweight protocol that does not require a handshake or acknowledgment.

The BigFix Server or Relays send UDP packets to the BigFix Clients on port 52311, which is the default port for BigFix communication.

The UDP packets do not contain any content, but only serve to notify the BigFix Clients that there is something new for them to gather.

Upon receiving a UDP notification, the BigFix Client initiates a TCP connection to the BigFix Server or Relay to gather the new content over a secure and reliable channel.

The UDP notification mechanism can be enabled or disabled by the BigFix Administrator, and it can also be configured to use different ports or multicast addresses.  References:

BigFix Architecture

BigFix Client Settings

BigFix Notification Guide

When installing the BigFix agent on a Windows endpoint, you can optionally include a pre-defined settings file in the same directory as the setup.exe file, to create custom settings for the Windows client at installation time, for example to assign the new client to a specific parent relay 1 .

The name of this file must be  clientsettings.cfg 1 2 .  This file should contain one setting per line, in the format  SETTING_NAME=SETTING_VALUE 2 3 .

The other options are incorrect because:

A, C, and D are not valid names for the settings file.  The BigFix agent will ignore them and use the default settings instead 1 2 .

For more information on how to use the clientsettings.cfg file and what settings can be defined, see the following references.  References:

1 :  Installing the Client using the .exe setup

2 :  Clientsettings.cfg question

3 :  Unix/Linux/Mac Client Deploy Tool

The default port used by BigFix for communication between servers, relays, and clients is  52311 1 2 .  This port must be unblocked for TCP/IP and UDP traffic on all internal routers and firewalls 1 . Therefore, option D is correct.

The default port used by BigFix WebUI for communication on HTTPS is  9031 3 . This port must be opened to allow access to the WebUI from a web browser. Therefore, option E is correct.

The other ports listed are not used by BigFix by default, and can be ignored or changed during installation. Therefore, options A, B, and C are incorrect.  References:

Network configuration requirements

Modifying port numbers

Network Port Conflicts

To create a schedule to delete duplicate computer records from the BigFix database, you need to use the BigFix Administration Tool 1 .

The BigFix Administration Tool is a separate application that allows you to perform various administrative tasks on the BigFix server, such as creating users, managing licenses, configuring encryption, and removing computers 1 .

To use the BigFix Administration Tool, you need to have the Master Operator role and access to the BigFix server machine 1 .

To create a schedule to delete duplicate computer records, you need to use the BES Computer Remover tool, which is a component of the BigFix Administration Tool 2 .

The BES Computer Remover tool allows you to automatically detect and remove inactive or duplicate computers from the BigFix database based on various criteria, such as last report time, computer name, IP address, or a custom property 2 .

To create a schedule to delete duplicate computer records, you need to follow these steps 2 :

Launch the BigFix Administration Tool and log in with your Master Operator credentials.

Select the BES Computer Remover tool from the left pane and click Run Now.

In the BES Computer Remover dialog, select the option to Find duplicate computers and specify the property to be used to identify duplicates, such as computer name, MAC address, or a custom property. You can also specify the minimum number of duplicates to be found before removal.

Click Next and review the list of duplicate computers that will be removed. You can also export the list to a file for future reference.

Click Next and select the option to Schedule the removal of computers. You can specify the frequency, start date, and end date of the schedule. You can also choose to send an email notification before and after the removal.

Click Finish and confirm the creation of the schedule. You can also view the status and history of the scheduled removals in the BES Computer Remover dialog.  References:

1 :  Using the BigFix Administration Tool

2 :  Removing computers from the BigFix database

3 :  Using the BigFix Administration Tool

4 :  Removing computers from the BigFix database

Baselines are collections of Fixlet messages and Tasks that can be deployed to a group of endpoints with a single command.

Baseline components are pointers to their corresponding source Fixlets or Tasks, which means that they do not contain the actual content, but only reference the original source.

Baseline components can get out of synchronization with their source Fixlets or Tasks, which means that the source content may change or become obsolete, while the Baseline component remains unchanged. This can cause issues such as incorrect relevance, missing downloads, or failed actions.

To avoid these issues, Baseline components should be synchronized with their source Fixlets or Tasks regularly, either manually or automatically. Synchronization updates the Baseline components with the latest content from the source Fixlets or Tasks, and also removes any components that are no longer available or relevant.

Baselines can be created by any user who has the permission to create content in a custom site. This includes Master Operators, who have full permissions to manage all aspects of the BigFix environment, as well as Non-Master Operators, who have limited permissions to manage specific sites or domains.

Baselines can include more than 100 components, but this is not recommended for performance and usability reasons. The optimal number of components for a Baseline depends on various factors, such as the size of the deployment, the complexity of the content, the frequency of the updates, and the network bandwidth. Generally, it is advisable to keep the Baseline components as few and simple as possible, and to group them logically by function or category.

Baselines can include other Baselines as components, which allows for creating nested or hierarchical Baselines. This can be useful for organizing and managing complex or large-scale deployments, such as patching multiple operating systems or applications. However, nesting Baselines also adds more layers of complexity and potential synchronization issues, so it should be done with caution and proper planning.  References:

Introducing Baselines

Creating or Customizing Baselines

Baselines

The WebUI is a web-based interface that provides access to the flexibility and power of BigFix.

The WebUI has some upper use limits that depend on many factors, such as the number of endpoints, the workload, the time of day, the server location, and the number of concurrent users.

Concurrent users are defined as highly active users who perform multiple actions per minute on the WebUI.

According to the BigFix Capacity Planning Guide, both the Windows and Linux WebUI instances support 36 concurrent users on a 250k deployment base. This is the recommended scalability limit for the WebUI server on BigFix v10.x.

The WebUI also requires additional hardware resources, such as CPU, memory, and storage, to power the WebUI. These resources are in addition to the BigFix root server requirements and depend on the number of concurrent users.

The WebUI also implements a database cache for several counters to improve the WebUI response times. The cache has a default refresh interval of 10 minutes.  References:

Hardware Requirements

WebUI Administrators Guide

BigFix WebUI

To create a custom Fixlet, you need to use the Action Script language, which is a set of commands that run on relevant clients to fix the problem identified by the Applicability Relevance clause 1 .

The Action Script language supports various types of scripts that can be executed on different operating systems, such as Windows, Linux, Mac OS, etc 2 .

Some of the valid Action Script types are:

waithidden  or  runhidden , which execute a command or script in the background without showing a window 2 .

wait  or  run , which execute a command or script in the foreground and show a window 2 .

override , which modifies the behavior of a command or script, such as changing the working directory, the user context, the completion timeout, etc 2 .

Among the options given in the question, Powershell and csh are valid Action Script types, as they are supported by the  waithidden ,  runhidden ,  wait , and  run  commands 2 .

Powershell is a scripting language for Windows systems, which can be executed by using the  powershell.exe  executable 2 .

csh is a shell script for Unix-like systems, which can be executed by using the  csh  command 2 .

AppleScript, Python, and Javascript are not valid Action Script types, as they are not supported by the Action Script language 2 .

AppleScript is a scripting language for Mac OS systems, which can be executed by using the  osascript  command 2 .

Python is a general-purpose programming language, which can be executed by using the  python  command 2 .

Javascript is a scripting language for web browsers, which can be executed by using the  cscript.exe  or  wscript.exe  commands on Windows systems 2 .

References:

The Action Script Language

Action Script Guide

BigFix clients can download resources directly from the Internet instead of their parent relay by using the  download now  command in the action script 1 .  This command bypasses the relay hierarchy and requests the file from the URL specified in the action script 2 .

However, this command may not be suitable for all scenarios, as it may consume more bandwidth and increase the download time 2 .  Therefore, BigFix provides several settings to control the download behavior of the clients based on different criteria 3 .

One of these settings is  _BESClient_Download_Direct_SubnetList , which allows the clients to download resources directly from the Internet if they are on a specific subnet 4 .  This setting is useful for clients that are connected to the enterprise network through a VPN, as they may have a faster connection to the Internet than to their parent relay 4 .

To enable this setting, the clients need to have the following values in their configuration files 4 :

_BESClient_Download_Direct = 1

_BESClient_Download_DirectRecovery = 1

_BESClient_Download_Direct_SubnetList = list of subnets separated by semicolons

For example, if the clients are on the subnets 172.31.148.0/22, 172.31.152.0/22, 172.31.156.0/22, 172.31.160.0/24, 10.31.148.0/22, 10.31.152.0/22, 10.31.156.0/22, or 10.31.160.0/24, the setting value would be 4 :

_BESClient_Download_Direct_SubnetList = 172.31.148.0/22;172.31.152.0/22;172.31.156.0/22;172.31.160.0/24;10.31.148.0/22;10.31.152.0/22;10.31.156.0/22;10.31.160.0/24

The other settings, such as _BESClient_Download_DirectPatchList, _BESClient_Download_Direct_Domainlist, and _BESClient_Download_Direct_ByVendor, are used to download resources directly from the Internet based on the patch name, the domain name, or the vendor name, respectively 3 . These settings are not relevant for the question scenario, as they do not depend on the client’s network location.  References:

Configuration Settings

Managing Downloads

Download Commands

Setting creation to download the patch content Directlyy

According to the BigFix Platform documentation, the upgrade Fixlet in the Support site does not upgrade a remote server correctly. You must run the full BigFix server installer to perform the upgrade.  Remote database setups might encounter problems during upgrade and require resetting database connection settings after manually running the BigFix Server installer 1 .

The upgrade procedure is as follows:

Upgrade the Server Installers using the Support Fixlets.

Run the Server installer as a user that has DB Owner or SA permissions to the database server. The installer recognizes that the Server is at an earlier version and asks if you want to upgrade to the latest version.

Run the BigFix Administrator Tool (BESAdmin.exe) to update the remote database tables; you will be prompted for the site admin password. Note: The BESAdmin.exe should be run automatically, if your account has the DB Owner or SA privileges to the remote database.

The BigFix server is now correctly upgraded.

The other options (A, B, and C) are not correct because:

Running the server installer as a local administrator does not guarantee that the user has the appropriate database permissions.

Using the upgrade Fixlets from the console does not work for a remote server setup.

Upgrading the server installers and using the upgrade Fixlets from the BigFix Console is redundant and unnecessary.

References:

Upgrading a BigFix server with a remote database

[BigFix Server Upgrade Guide]