The software usage metrics 'last_used' is not being collected for all the software installations - Known Error

The software usage metrics 'last_used' is not being collected for all the software installations Description The software usage metrics 'last_used' is not being collected for all the software installations.

Note: This is applicable for ACCVC versions below 2.0.4

Steps to Reproduce

Run 'Installed Software' check on the Agent Observe that the last_used field is not populated for all the Software Installation records returned in the input.

Workaround The root cause of this can be the inconsistency of the software names in OSQuery tables.

From the ACC-V Nov 2024 release, we provide an option to add mappings of such software's names (actual name -> name in OSQuery table). To update this mapping, follow the steps below:

Go to the 'sn_agent_configuration_file' table, open the 'SoftwareNameMapping.json' record, and download the attached 'SoftwareNameMapping.json' file. Locally, update this file with the mappings of the software experiencing issues. Format of the file:-

{ "Visual Studio Professional 2022": "VisualStudio", "Visual Studio Professional 2019": "VisualStudio", " ": " " }

To find the mapping, use the 'Display name' field's value in the Software Installations table and the software name found in the OSQuery command's output.

OSQuerycommand:- osqueryi.exe --config_path "" --json --logger_min_status 1 "select p.path, p.last_execution_time, p.count, u.username from users u CROSS JOIN userassist p on p.sid=u.uuid order by p.last_execution_time desc;"

3. After updating the file locally, delete the previous file and upload the updated file with new mappings to the instance (on the sn_agent_configuration_file table).

4. This new file will automatically be synced to all agents, and the last_used field will start appearing in the ECC queue.