4 Replies Latest reply on Jul 22, 2016 11:25 AM by carlos

    Task initialized from portal vs auto

    carlos Expert

      LDMS 9.6 SP2

      Is there a log that I can check to see if a software installation was initialized by the user vs auto?

      Any input is appreciated.

        • 1. Re: Task initialized from portal vs auto
          phoffmann SupportEmployee

          Can you provide a little more context here?

           

          Since packages that are of the "install automatically" type are configured as such in the Console, you should know about what gets pushed out automatically versus what's on offer?

           

          Or is this a minor "ooops - didn't mean to have it be automatically deployed" type situation (in which case - why does it matter)?

           

          The SDCLIENT-side logs won't tell you who initiated things, they'll just care about logging "how the install went".

           

          For the rest, there may be some stuff - it'd just help having a bit more context about what/why you're after it ... and how your users do stuff (i.e. - do you use Workspaces or the older policy portal)?

           

          ... Policy-logs should tell you about required policies (there'll be a log entry along the lines of "running required" or so) ... would need to do some digging around specific "user kicked this one off" type stuff. I'm tempted to say "yes" (but it being a few minutes before I shut down for the weekend, I could be recollecting incorrectly) ... having some more info would be nice.

          • 2. Re: Task initialized from portal vs auto
            carlos Expert

            Hello, this is one of those MAYOR "ooops - didn't mean to have it be automatically deployed" type situation ... One package was deployed that didn't suppose to be.

            I'm pretty sure the task is correct and it should not deployed the package, but it was, which leds me to think that someone clicked the package from the portal manager, but I need to be absolutely sure, you mention that "The SDCLIENT-side logs won't tell you who initiated things, they'll just care about logging "how the install went" so i wont be able to know how that happened?

             

            Regards.

            • 3. Re: Task initialized from portal vs auto
              phoffmann SupportEmployee

              I was rattling through the list of various logs involved (the two "sure fire" ones being SDCLIENT (which does the actual installing) and PolicySync (which checks what's targeted against the devices).

               

              Can't really look at logs in detail (as my VM-s are locked out for a few hours running a bunch of upgrade type stuff that I can't stop now) ... is this OK to wait 'til next week, or is this super urgent? (Sod's law being that I only noticed this thread after effectively killing my machine for the next few hours).

               

              So PortalManager has a log - "LANDeskPortalManager.log" in - "C:\ProgramData\LANDesk\Log\". You might check what that has to say for itself (my box doesn't have any policies targeted against it so I couldn't experiment, as I'm out of VM-s I can launch up).

               

              The "PolicySync.exe.log" log should only have entries about X many policies being required & running them ... so that with date/time stamps from the SDCLIENT might be something.

               

              On to the files in "C:\Program Files (x86)\LANDesk\LDClient\Data\"

              • The "TaskHistory.xml" (Open it in IE for easier readability) doesn't list who kicked a task off.
              • The SDCLIENT.TASK.### log(s) (where the ### is the TASK_IDN) could be of use (if you cross-check them against the policy logs)

               

              OK - so here's an example POLICYSYNC.EXE.LOG extract of finding a new required policy & running it (note the bold line) - so that gives you that sort of time-stamp / string to search for:

              07/22/2016 17:50:20 INFO  5100:1 RollingLog : Request: GetWebResponse ok
              07/22/2016 17:50:20 INFO  5100:1 RollingLog : Request: Has 5 targeted policies
              07/22/2016 17:50:20 INFO  5100:1 RollingLog : RunPolicySync: ProcessRequestedPolicies
              07/22/2016 17:50:21 INFO  5100:1 RollingLog : LoadLocalPolicyInfo: load local machine
              07/22/2016 17:50:21 INFO  5100:1 RollingLog : LoadLocalPolicyInfo: load user
              07/22/2016 17:50:21 INFO  5100:1 RollingLog : HandleRunNow: has 1 run now policies
              07/22/2016 17:50:21 INFO  5100:1 RollingLog : Exit PolicySync.exe with code 0

               

              07/22/2016 17:50:21 INFO  1136:1 RollingLog :

              Run PolicySync.exe /enforce

              07/22/2016 17:50:21 INFO  1136:1 RollingLog : EnforcePolicies: check and run RunNow and Reoccurring policies

               

               

               

              ... and here's me installing a policy from the policy portal (myself "on demand" as a user) - check the "LANDeskPortalManager.exe.log"

              07/22/2016 17:50:01 INFO  4916:1 RollingLog : PreservedViewName: Do not has saved view name, try default one
              07/22/2016 17:52:25 INFO  4916:1 RollingLog : Start install: Notepad Via Batch
              07/22/2016 17:52:41 INFO  4916:1 RollingLog :  Downloading Finished for Notepad Via Batch
              07/22/2016 17:52:42 INFO  4916:1 RollingLog :  Installing Notepad Via Batch

               

               

               

              So ... if "the policy name" shows up in the "LANDeskPortalManager.exe.log", then users installed it via the policy portal at their request / on-demand. The "required" policy didn't put any log-entries into that log.

               

              That should make life easier for you no? .

              • 4. Re: Task initialized from portal vs auto
                carlos Expert

                phoffmann,that is correct, manual installations from the Portal does show an entry in LandeskPortalManager.exe.log AUTO does not.

                TNX!