Every month we take questions for Dr. K. and answer the best one in front of the world!
Have a question for Dr. K? Send an e-mail to firstname.lastname@example.org
Question: Dr. K- Is it possible to get instant alerts when software is detected/no longer detected? If so, how?
Answer: Well, not really “instant”, but you can get them pretty quickly. A few terminology things to keep in mind-
- Alerts=Desktop Messaging; Displayed locally upon agent inventory.
- E-Mail Alerts=E-mail to specific user about a condition; sent up to every 15 minutes.
- Scheduled Reports=Highly customizable E-Mail; send up to every hour.
With that in mind, you might choose to use any or all of the options. For example- a good alert might be detecting the presence of unwanted software and displaying a desktop alert to the user reminding them of a policy; supplement that with a script or Managed Install to remove the software title. A good notification or report might be something like this:
SELECT CONCAT(S.DISPLAY_NAME, ' ', S.DISPLAY_VERSION) AS 'Software', A.NAME as 'Computer', AH.TIME as 'Installed' FROM ASSET_HISTORY AH, ASSET A, ASSET_TYPE AST, SOFTWARE S WHERE AST.ASSET_CATEGORY = "Computer" and A.ID = AH.ASSET_ID and DATE(AH.TIME) > DATE(DATE_SUB(NOW(), INTERVAL 24 HOUR)) ORDER BY Installed, Computer
There are many other examples of SQL and similar approaches on ITNinja. One of my favorite examples that shows some good efforts towards filtering out commonly accepted items such as patches is http://www.itninja.com/question/software-changes-history Adjust the interval portion to fit your desired schedule so you don’t get too much overlap. For example if I were running the report daily, I’d set the interval to INTERVAL 2 DAY but if I were getting mail hourly i’d likely set it to INTERVAL 90 MINUTE. Hope that helps!
Thanks for the question – I’ll get you a prize soon for picking your question!