Data import warnings

Warning messages

File Facts Result exceeding limit of files

Step: ETL SAM::FileFact

Versions: 10.0.4 or higher

Message in data import log:

Import: FileFactHandler:42780) FileFactHandler::endDocument::File
44575::0::AE5142947EA6176C027C33DCA8EEBF7A02F76E60::\20\1086551120\
itsitsearch_0_1086551120.xml.bz2
on computer 44575 has 12224 lines which is above the limit of 10000 lines.
All entries will be imported.

Meaning: Warning message that appears about exceeding 10000 entries for File Scan result on a given computer. Review the Scanned File Data on the computer using provided computer ID in the log. Consider excluding some directories from scan.

File Facts Result exceed limit of size (Default: 4 MB)

Step: ETL SAM::FileFact

Versions: 10.0.4 or higher

Message in Data Import Log:

WARN:  (ImportFileFactAction) Skipping file itsitsearch_0_1081026664.xml.bz2 on computer 22137 of size
6611177 B because it is over limit of 4194304 B. Nothing to import.

Meaning: Warning message about exceeding the limit of Scan Result maximum size (scanFileSizeLimit Advanced Server Settings). The scan result is not processed and as a result, no changes are made to existing data. Get the Computer Support Data and review the File Scan result at itsitsearch_0_<comptuer_id>.xml.bz2 against possible exclusions from the scan.

Issue with SLM Tag scan result

Step: SlmTagImport

Versions: 10.x

Message in Data Import Log:

WARN:(ImportSlmTags-Thread:2) SlmTagsScanFileHandler::handle::Wrong file for computer id = 33948 provided.

Meaning: Issue with SLM Tag Scan Result preventing processing of the scan result. There might be a corrupt, empty or missing list.txt file inside. Review SLM Tag Scan Result file slmtagsearch_0_<comptuer_id>_*_slmtag.tar.gz/.zip.

Application usage data exceeds limit of size 1 MB

Step: SAM::RawAppUsagePropertyValue

Versions: 10.x

Message in Data Import Log:

WARN: Application Usage Data for remote computer with ID 552839986 trimmed to 1MB.
The data exceeds the allowed length.

Meaning: The result is larger than 1MB and only first 1MB is stored. This can happen on systems that have been existing since long. For example automation tools that create and run one time and unique processes or executables. As a result, it is ordered from most recent changes applications usage are updated in this case. The most recent Initiate Software Scan fixlet must be used to prevent this warning message.

Issue with fetch file from BigFix Platform

Step: Various: CIT Facts, ISO Tag Facts...

Versions: 10.x

since long

Message in Data Import Log:

WARN: Received only 46 of 3009 bytes of \35\550993735\citsearch_0_550993735_cit.xml.bz2 / }
WARN: Registering failed read for file citsearch_0_550993735_cit.xml.bz2 on computer 856590

Meaning: The most common issue is BigFix Platform being overloaded or any change in the file when BigFix Inventory fetches data during the RawDataSourceFile step. As a result, the file is marked for re-read during the next import.

Unable to get the path and name from string

Step: File Fact Import

Versions: 10.x

Message in Data Import Log:

WARN:(Import: FileFactHandler:57465)com.ibm.license.mgmt.etl.core.actions.filefact.
FileFactRecordBuilder::build::Could not parse file for computer: 2071634,
unable to get path and name from string: "runcit_sw.sh", skipping invalid record.

Meaning: Malformed entry in file system scan. Such entry is ignored. Ensure that most recent Initate Software Scan is being used.

UUID not found - processing of duplicate guests from VM Manager is skipped

Step: VMManager Data Import

Versions: 10.x

Message in Data Import Log:

WARN:[ILMTCore] (ImportMergeTask-Thread:1) MergeGuestStrategy::process::
UUID:8429-4789-0735-0157 3771-6736-98 was found: 
on host HOST1.HOSTNAME.ORG (PROCESSED)
on host HOST2.HOSTNAME.ORG (DUPLICATE)
skipping processing of duplicated guest from vm manager (https://VMMAN.HOSTNAME.ORG:5986/wsman)

Meaning: In BigFix Inventory each device requires an assigned unique ID to be able to correctly place the VMs in virtualization hierarchy. If there is a duplicate ID, the entry is rejected and the VM is not placed in the virtualization hierarchy. It is mandatory for the VM UUID to be unique.

The affected VMs are listed in the message.

No virtual machine detected

Step: VMManager Data Import

Versions: 10.x

Message in Data Import Log:

WARN:[ILMTCore] (ImportMergeTask-Thread:1) There is no virtual machines detected in the vm manager
scan result. Scan taken by vm manager tool on computer with id 828655 to vm manager
https://VMMAN.HOSTNAME.ORG/sdk/vimService.wsdl at Tue Apr 12 03:48:55 UTC 2022.
Please verify whether defined user (BFI_USER@HOSTNAME.ORG) has read rights to all required objects.

Meaning: The message about no VM being detected appears. It does not show the reason behind the VM not being detected. The reason can be insufficient permission or lack of VMs deployed. If the issue persists, it is recommend to check permissions.

VM Manager has been marked as deleted

Step: VM Manager Data Import

Versions: 10.x

Message in Data Import Log:

2022-04-12 15:20:26 (+0:00:00.015) WARN: [ILMTCore] (ImportMergeTask-Thread:1)
MergeDataTask::processTask::That vm manager has been marked as deleted, the data coming from this VM manager
will be discarded.

Meaning: Removal of the VM Manager configuration in VM Manager panel results in ignoring any future result appearing from such configuration. It appears only in the next import as data from VM Manager might be already collected and waiting for import.

Missing computer ID

Step: SAM::AppUsage SAM::DeepHw SAM::SharedDisk

Versions: 10.x

Message in Data Import Log:

WARN:  (ImportThread) Skipping import of computer data: Computer ID missing for datasource 7.

Meaning: It is not possible to map Remote Computer ID to the computers known to BigFix Inventory. This might be possible because of synchronization issue. Contact support if the problem persists.

Exception while decrypting scan result

Step: SAM::CitFact SAM::IsotagFact

Versions: 10.x

Message in Data Import Log:

WARN: Exception while decrypting DatasourceFile citsearch_0_6076322_cit.xml.bz2  Error was pad block corrupted in
org/jruby/ext/openssl/Cipher.java:1210:in `final'
D:/Program Files/ibm/BFI/wlp/usr/servers/server1/apps/tema.war/WEB-INF/app/models/datasource_file.rb:155:in `get_data_from_bigfix_server'
D:/Program Files/ibm/BFI/wlp/usr/servers/server1/apps/tema.war/WEB-INF/app/models/datasource_file.rb:109:in `read_data_into_mem'
D:/Program Files/ibm/BFI/wlp/usr/servers/server1/apps/tema.war/WEB-INF/domains/sam/app/models/sam/scan_file.rb:62:in `get_file_into_datasource_file'
D:/Program Files/ibm/BFI/wlp/usr/servers/server1/apps/tema.war/WEB-INF/domains/sam/app/models/sam/cit_fact.rb:82:in `block in etl_source'
D:/Program Files/ibm/BFI/wlp/usr/servers/server1/apps/tema.war/WEB-INF/lib/threaded_mapper.rb:76:in `block in initialize'
WARN: Registering failed read for file citsearch_0_6076322_cit.xml.bz2 on computer 12565

Meaning: BigFix Inventory fetches information about the files to import at the beginning of the Data Import. During the import process those files might be updated on BigFix Platform side and information read at the beginning does not match current state. For this reason, file is being fetch but cannot be decrypted. Such file is marked as "Read Failed" and will be repeated on next import.

It can happen if the scan was forced one more time after regular scan not yet imported by BigFix Inventory.

Disconnected Scan: Importing older scan package from:

Step: SAM::DisconnectedScan

Versions: 10.x

Message in Data Import Log:

WARN: Importing older scan package from: 2022-01-10T14:59:00+00:00 for computer: 218986. This computer already has data from: 2022-01-10 14:59:00 UTC.

Meaning: When importing more then one package form single device older results are ignored with the above message.

Disconnected Scan: Skipping file

Step: SAM::DisconnectedScan

Versions: 10.x

Message in Data Import Log:

INFO: Skipping file: scanner_status.yml. Unsupported file in: 202201101459-7839250-28.zip.

Meaning: Disconnected Scanner package might include additional files that are not recognized by scanner and ignored with the above message.

Destination for disconnected scan package already exists

Step: SAM::DisconnectedScan

Versions: 10.x

Message in Data Import Log:

WARN: Exception while processing Disconnected Scan package 202201031457-7839250-28.zip. Only first 16
packages has been processed. Fix the problem by removing package causing error.
The following error occurred: Destination 'D:\Program Files\ibm\BFI\wlp\usr\servers\server1/tmp/datasources/
12/UploadManager/sha1/40/40/cit_capacity_1_40_tlm_hw.zip' already exists

Meaning: There is an issue with extraction of Disconnected Scanner package due to an issue with overwriting the file on the disk. File is located on host of BigFix Inventory Server in provided location. Consider removing file and running Data Import again.

Issues, such as missing physical processor group, missing lpar group, or inconsistency in the HW scan file received

Step: ETL from ImportCapacity

Versions: 10.x

Message in Data Import Log:

INFO: ETL from ImportCapacity: Start
WARN: [ILMTCore] (ImportCapacity-Thread:0) The HW scan file received from agent does not contain a
physical processor group.
WARN: [ILMTCore] (ImportCapacity-Thread:0) The HW scan file received from agent is not consistent,
discarding the HW scan results...If no other detailed information is traced earlier, the problem may be
in missing 'Lpar' group in HW scan output or missing or empty PhysicalProcessor group.
WARN: [ILMTCore] (ImportCapacity-Thread:0) CapacityScanFileHandler::processTask::Some error occurred
during importing the capacity scan from file : tlm_hw_202201170706_1642424799.xml for endpoint : 41303.

Meaning: Malformed Capacity scan result. Check Hardware Inventory: Status for listed computer. Ensure that there are no known defects on the BigFix Inventory Scanner / Run Capacity Scan and Upload Results fixlet for the given OS. Consider upgrading to most recent version.

Inconsistent data detected when inventory builder is run

Step: ETL from InventoryBuilder

Versions: 10.x

Message in Data Import Log:

INFO:  (ImportThread) ProductInventoryBO: before dropAndCreateDiscoveredSoftwareDetailsTable ->
ultimateUpdateDiscoveredSoftwareDetailsTable
WARN:  (ImportThread) Some data inconsistency detected during inventory builder - there was more then one current records with the same instance_hash present.Total number of problematic records is: 4.

Meaning: It is an unexpected condition when creating Software Classification view leading to have more then one Component Instance (Software Component with given Release in given path on given computer). BigFix Inventory drops one of entries to avoid duplicates. Check if you are on most recent version of BigFix Inventory Server. If the issue persists, contact support to determine the scenario and adjust Inventory Builder logic.

Missing CVE file for the current year

Step: Calculating software components vulnerability risk based on NIST NVD

Versions: 10.x

Message in Data Import Log:

WARN:  (ImportAndProcessCVE) com.ibm.license.mgmt.bfi.bl.cve.CVELoader::loadNextFile::Missing file for
year 2022

Meaning: When the year changes and BigFix Inventory server is upgraded after (or later) the first date of the year, the server does not include the new files, the above warning appears. Upgrade BigFix Inventory server once again (subsequent upgrade) to allow the new files get included. The warning disappears after the upgrade. Refer to this section to learn about subsequent upgrade procedure.

Platform of the computer is not defined

Step: Calling Model.after_snapshot

Versions: 10.x

Message in Data Import Log:

WARN: There are multiple computers with not well determined Platform.
Software will not be properly discovered on them. Listing top 10:

Example:

Datasource:  <DS> Computer:   (Id: <ID> RemoteId: <ID>) OS: ANY Platform:  IsUnix: 1
Datasource:  <DS> Computer:   (Id: <ID> RemoteId: <ID>) OS: ANY Platform:  IsUnix: 1

Meaning: To match with correct signatures, BigFix Inventory requires the platform of the computer to be correctly defined so that the signatures can have limited scope to particular platform only. Platform is assessed based on the OS property. This property might not be available or there can be some issue with synchronization of this property between BigFix Inventory and BigFix Platform. As a result, computer does not have defined platform. This warning indicates if there are any such computers in the system. When all computers have proper setting the message All computers got proper Platform set appears. In case when computers are listed with such error it is needed to go to Management > feature page and use the "Import all computer properties and do matching of all facts once again (next import only)" option to resolve the issue. If the problem occurs again, check procedures for rolling out BigFix Agents. Ensure that they are properly initiated and have sufficient time to report the basic data and this information reaches the BigFix Platform.