Quantcast
Channel: Symantec Connect - Endpoint Management
Viewing all articles
Browse latest Browse all 7217

How to find out where a package was downloaded from?

$
0
0

This article includes the evolution of a report, by merging two queries together.

DISCLAIMER:  The machine names, IP Addresses and Domain names are ficticious lab values that no longer exist.

 

The following query utilises default SMP database objects, and provides a packages download method to a specific resource:

 

SELECT CASE

WHEN charindex('http://', [URL]) > 0 THEN 'HTTP'

WHEN charindex('https://', [URL]) > 0 THEN 'HTTPS'

WHEN charindex('\\', [URL]) > 0 THEN 'UNC'

WHEN charindex('Multicast', [URL]) > 0 THEN 'Multicast'

ELSE ''

END COLLATE DATABASE_DEFAULT AS PackageDownloadMethod,

p.PackageName,vc.Name AS Computer,vc.Domain,vc.[IP Address],vc.[User]

FROM Evt_AeX_SWD_Package p

JOIN vComputer vc ON vc.[Guid] = p._ResourceGuid

WHERE (LEN(URL) > 0) AND (EventType = 'End')

AND p.PackageName = 'Desktop Rover'

ORDER BY PackageDownloadMethod ASC

15.png

 

 

As you can see, the above query is missing one important piece of information, and that is where was the package downloaded from.  The following query is used by the vITAnalytics_CMDB_PackageDownloadSourceDim view to work out the download source.  The good thing about this view is that it does not need ITA to be configured, as it interrogates default SMP database objects:

 

SELECT DISTINCT PackageDownloadSourceName, PackageDownloadSourceType

                  FROM (SELECT    

                  CASE WHEN charindex('.', [Name]) > 0 THEN upper(substring([Name], 0, charindex('.', [Name]))) ELSE Name END COLLATE DATABASE_DEFAULT AS  PackageDownloadSourceName,

                  'Notification Server' COLLATE DATABASE_DEFAULT AS PackageDownloadSourceType

                  FROM [SQL-W2K8-01].[Symantec_CMDB_2].[dbo].[vNotificationServerSource] as vNotificationServerSource

                  UNION

                  SELECT DISTINCT vc.Name COLLATE DATABASE_DEFAULT AS  PackageDownloadSourceName, 'Package Server' COLLATE DATABASE_DEFAULT AS  PackageDownloadSourceType

                  FROM

                  [SQL-W2K8-01].[Symantec_CMDB_2].[dbo].[vComputer] AS vc INNER JOIN

                  [SQL-W2K8-01].[Symantec_CMDB_2].[dbo].[SWDPackageServer] ON vc.Guid = SWDPackageServer.PkgSvrId

                  UNION

                  SELECT     PackageDownloadSourceName COLLATE DATABASE_DEFAULT AS PackageDownloadSourceName

                  , 'Non-Altiris Server' COLLATE DATABASE_DEFAULT AS PackageDownloadSourceType

                  FROM         (SELECT DISTINCT

                                                                                    CASE WHEN charindex('//', [URL]) > 0 THEN upper(substring(substring([URL], charindex('//', [URL]) + 2, len([URL]) - charindex('//', [URL]) - 1), 0, charindex('/',

                                                                                    replace(substring([URL], charindex('//', [URL]) + 2, len([URL]) - charindex('//', [URL]) - 1), '.', '/')))) WHEN charindex('\\', [URL])

                                                                                    > 0 THEN upper(substring(substring([URL], charindex('\\', [URL]) + 2, len([URL]) - charindex('\\', [URL]) - 1), 0, charindex('\', replace(substring([URL],

                                                                                    charindex('\\', [URL]) + 2, len([URL]) - charindex('\\', [URL]) - 1), '.', '\')))) WHEN charindex('Multicast download complete. Master: ', [URL])

                                                                                    > 0 THEN upper(substring([URL], charindex('Multicast download complete. Master: ', [URL]) + 37, len([URL])

                                                                                    - charindex('Multicast download complete. Master: ', [URL]) - 36)) ELSE NULL END COLLATE DATABASE_DEFAULT AS PackageDownloadSourceName,

                                                                                    'Non-Altiris Server'COLLATE DATABASE_DEFAULT AS PackageDownloadSourceType

                                                  FROM [SQL-W2K8-01].[Symantec_CMDB_2].[dbo].[Evt_AeX_SWD_Package] AS Evt_AeX_SWD_Package

                                                  WHERE      (LEN(URL) > 0) AND (EventType = 'End')) AS PSSource

                  WHERE     (PackageDownloadSourceName NOT IN

                                                       (SELECT     CASE WHEN charindex('.', [Name]) > 0 THEN upper(substring([Name], 0, charindex('.', [Name]))) ELSE Name END AS Name

                                                           FROM          [SQL-W2K8-01].[Symantec_CMDB_2].[dbo].[vNotificationServerSource] AS vNotificationServerSource_1

                                                           UNION

                                                           SELECT DISTINCT vc.Name

                                                           FROM         [SQL-W2K8-01].[Symantec_CMDB_2].[dbo].[vComputer] AS vc INNER JOIN

                                                                                          [SQL-W2K8-01].[Symantec_CMDB_2].[dbo].[SWDPackageServer] AS SWDPackageServer_1 ON vc.Guid = SWDPackageServer_1.PkgSvrId))

                  ) AS PackageDownloadSourceDim

16.png

 

 

This final query merges the first two together in order to provide the complete picture:

 

SELECT psrc.PackageDownloadMethod

         , psrc.PackageDownloadSourceName

         , d.PackageDownloadSourceType

         , psrc.PackageName

         , psrc.Computer

         , psrc.Domain

         , psrc.[IP Address]

         , psrc.[User] 

FROM (

SELECT CASE

      WHEN charindex('http://', [URL]) > 0 THEN 'HTTP'

      WHEN charindex('https://', [URL]) > 0 THEN 'HTTPS'

      WHEN charindex('\\', [URL]) > 0 THEN 'UNC'

      WHEN charindex('Multicast', [URL]) > 0 THEN 'Multicast'

      ELSE ''

END COLLATE DATABASE_DEFAULT AS PackageDownloadMethod

,CASE WHEN charindex('//', [URL]) > 0 THEN upper(substring(substring([URL],

charindex('//', [URL]) + 2, len([URL]) - charindex('//', [URL]) - 1), 0,

charindex('/', replace(substring([URL], charindex('//', [URL]) + 2,

len([URL]) - charindex('//', [URL]) - 1), '.', '/'))))

WHEN charindex('\\', [URL]) > 0 THEN upper(substring(substring([URL], charindex('\\',

[URL]) + 2, len([URL]) - charindex('\\', [URL]) - 1), 0,

charindex('\', replace(substring([URL],

charindex('\\', [URL]) + 2, len([URL]) - charindex('\\', [URL]) - 1), '.', '\'))))

WHEN charindex('Multicast download complete. Master: ', [URL]) > 0

THEN upper(substring([URL], charindex('Multicast download complete. Master: ',

[URL]) + 37, len([URL]) - charindex('Multicast download complete. Master: ',

[URL]) - 36)) ELSE NULL END AS PackageDownloadSourceName

, p.PackageName ,vc.Name AS Computer ,vc.Domain ,vc.[IP Address] ,vc.[User]

FROM Evt_AeX_SWD_Package p

JOIN vComputer vc ON vc.[Guid] = p._ResourceGuid

WHERE (LEN(URL) > 0) AND (EventType = 'End')

AND p.PackageName = 'Desktop Rover') psrc

left outer join vITAnalytics_CMDB_PackageDownloadSourceDim d

on psrc.PackageDownloadSourceName = d.PackageDownloadSourceName

ORDER BY PackageDownloadMethod ASC

17.png

 


Viewing all articles
Browse latest Browse all 7217

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>