Trouble shooting guide for SAM Total Usage Metric - Support and Troubleshooting

Trouble shooting guide for SAM Total Usage Metric Description The article explains about the possible errors and its solutions for SAM Total Usage Metric feature in the ACC-V plugin.

Instructions SAM Total Usage Metric runs only on windows endpoint devices.

1. Error in Windows - SAM background policy:

Solutions: for any issues related to Windows - SAM background policy check for all the possible solutions mentioned below

Mid server and agent should be up and running Osqueryd process should be running in the target endpoints. Verify if osquery is installed in the default location : If osquery is not installed at the above mentioned location, find the location where it is installed and copy the path till logs folder and pass it as a parameter to the command in the check instance under the policy as mentioned below. sam_processor.rb --osquery_log=" " Check if osquery.conf file has the below mentioned custom query under schedule keyword. If not add it under schedule keyword ”schedule”:{ "sam_process_info": { "query": "select name ,pid, elapsed_time, start_time, user_time, system_time, username from processes p JOIN users u ON u.uid = p.uid where p.elapsed_time != -1 ;", "snapshot" : true, "interval": 300 } } Navigate to Osquery Installation folder find and edit osquery.flags file. Add the below flags and save it. Note: Modification of the log file size should be done as per the sizing guidelines

--logger_rotate=true

--logger_rotate_size=26214400

--logger_rotate_max_files=1

--watchdog_level=-1

After above 2 configuration are done we are good to start the Osqueryd service.

2. Error in Windows - SAM discovery policy:

Solutions:

Verify if the marker.json is created at the location " \\AppData\\Local\\AgentClientCollector\\SAM" Userprofile is the profile of the user which is configured for ACC. This file would be automatically updated at the interval of 5 min The file will have data in the json format. {data: {}, lastReadUnixTime: } 3. Data not getting persisted in the staging table - sn_acc_visibility_sam_software_usage_staging

Solutions:

Check for the agent payload in the instance if it contains any of the below mentioned points under SAM payload. Marker File does not exists will retry in the next run: check for all the solutions mentioned in the 2nd point. If property "unixTime"=-1: check for solutions mentioned in 1st point Reclamation rules should be created in the instance for reclamation type "Total Usage Time" in the table -> "Reclamation Rules " Add all the necessary products in the rule The processes names in the payload should either match with entries from "Software product process" or "Software Installation" tables. Records in the "Software Installation" table should be normalised. User that is sent in the sam payload should match with the userId from the users table ( sys_user ) in the instance, If not create an entry in the user table. 4. Data not stored in the final table - samp_sw_usage

Solutions:

Check whether the scheduled job ( SAM - Update Software Total Usage Metric ) is active and has executed

For any other script issues from the instance, check in the system log with prefix "Exception in EnhancedDiscoveryHandler.persistSAMAdvancedStagingData()"