HCL-BF-PRO-10 HCLSoftware U Certified Professional-BigFix Platform 1 Question and Answers

• A BigFix Enterprise Server (BES) is the central component of the BigFix architecture that manages and communicates with the BigFix agents and relays1.
• The BES consists of several subcomponents, such as the root server, the console, the web reports, the web UI, and the server API1.
• The BES can support up to 300,000 endpoints in a single deployment, depending on the hardware configuration, network bandwidth, and workload2.
• The BES capacity planning document provides guidelines and recommendations for sizing and scaling the BES components based on various factors, such as cores, memory, network, storage, cloud, and concurrent users2.
• The BES capacity planning document also provides examples of typical deployments and best practices for optimizing the BES performance and stability2. References:
• BigFix Platform Overview
• BigFix Capacity Planning

To upgrade a DSA environment, the following steps are required:

• Run the BigFix Server upgrade on the primary server first, following the manual upgrade instructions1.
• Verify that the primary server is upgraded successfully and that all the services are running.
• Run the BigFix Server upgrade on the secondary servers, one at a time, following the same manual upgrade instructions1.
• Verify that the secondary servers are upgraded successfully and that all the services are running.
• Verify that the DSA replication is working properly and that the data is consistent across all the servers.

References:

• Manual upgrade - HCL Product Documentation
• BigFix Wiki - BigFix Upgrade Best Practices
• Deploy newer version of BigFix Server on DSA, viable?

According to the BigFix Platform documentation1, the standard Relay configuration can support up to 5,000 endpoints per Relay, while the high scale Relay configuration can support up to 10,000 endpoints per Relay. The high scale Relay configuration requires more hardware resources and tuning parameters than the standard Relay configuration. To configure a high scale Relay, you need to follow these steps2:

• Install the Relay on a dedicated server with at least 8 CPU cores, 16 GB of RAM, and 500 GB of disk space.
• Set the _BESRelay_HTTPServer_MaxConnections setting to 2000 on the Relay.
• Set the _BESRelay_PostResults_ParentRelayBufferDirectoryMaxSize setting to 10000000000 on the Relay.
• Set the _BESRelay_PostResults_ParentRelayBufferDirectoryMaxCount setting to 100000 on the Relay.
• Set the _BESRelay_PostResults_ChildRelayBufferDirectoryMaxSize setting to 10000000000 on the Relay.
• Set the _BESRelay_PostResults_ChildRelayBufferDirectoryMaxCount setting to 100000 on the Relay.
• Set the _BESRelay_Download_LimitBytesPerMinute setting to 0 on the Relay.
• Set the _BESRelay_Download_LimitBytesPerMinutePerClient setting to 0 on the Relay.
• Set the _BESRelay_Download_PreCacheStageDiskLimitMB setting to 100000 on the Relay.
• Set the _BESRelay_Download_PreCacheStageDiskLimitPercent setting to 0 on the Relay.
• Set the _BESRelay_Download_CacheLimitMB setting to 100000 on the Relay.
• Set the _BESRelay_Download_CacheLimitPercent setting to 0 on the Relay.
• Restart the Relay service after applying the settings. References:
• Relay scalability
• Configuring a high scale Relay

• BigFix clients can download resources directly from the Internet instead of their parent relay by using the download now command in the action script1. This command bypasses the relay hierarchy and requests the file from the URL specified in the action script2.
• However, this command may not be suitable for all scenarios, as it may consume more bandwidth and increase the download time2. Therefore, BigFix provides several settings to control the download behavior of the clients based on different criteria3.
• One of these settings is _BESClient_Download_Direct_SubnetList, which allows the clients to download resources directly from the Internet if they are on a specific subnet4. This setting is useful for clients that are connected to the enterprise network through a VPN, as they may have a faster connection to the Internet than to their parent relay4.
• To enable this setting, the clients need to have the following values in their configuration files4:
• For example, if the clients are on the subnets 172.31.148.0/22, 172.31.152.0/22, 172.31.156.0/22, 172.31.160.0/24, 10.31.148.0/22, 10.31.152.0/22, 10.31.156.0/22, or 10.31.160.0/24, the setting value would be4:
• The other settings, such as _BESClient_Download_DirectPatchList, _BESClient_Download_Direct_Domainlist, and _BESClient_Download_Direct_ByVendor, are used to download resources directly from the Internet based on the patch name, the domain name, or the vendor name, respectively3. These settings are not relevant for the question scenario, as they do not depend on the client’s network location. References:
• Configuration Settings
• Managing Downloads
• Download Commands
• Setting creation to download the patch content Directlyy

• The default port used by BigFix for communication between servers, relays, and clients is 5231112. This port must be unblocked for TCP/IP and UDP traffic on all internal routers and firewalls1. Therefore, option D is correct.
• The default port used by BigFix WebUI for communication on HTTPS is 90313. This port must be opened to allow access to the WebUI from a web browser. Therefore, option E is correct.
• The other ports listed are not used by BigFix by default, and can be ignored or changed during installation. Therefore, options A, B, and C are incorrect. References:
• Network configuration requirements
• Modifying port numbers
• Network Port Conflicts

• The license.pvk file is the private key file that is part of the BigFix license. It is protected by a password that is set during the installation of the BigFix server.
• The license.pvk file is used to authenticate the BigFix Master Operators, who are the highest level of authority in the BigFix hierarchy. They can perform any action on any computer or site in the BigFix deployment.
• The license.pvk file is also used to sign the masthead file, which contains the configuration settings and the public key for the BigFix deployment. The masthead file isdistributed to all BigFix components, such as clients, relays, and consoles, to verify the identity and authority of the BigFix server.
• The license.pvk file is not used to authenticate the BigFix Site Administrator, who is a special Master Operator that can manage the license and the masthead files. The Site Administrator uses the site admin password to access the license.pvk file and perform license-related tasks.
• The license.pvk file is not used to authenticate the BigFix local operators, who are the lower level of authority in the BigFix hierarchy. They can only perform actions on the computers and sites that are assigned to them by the Master Operators. The local operators use their username and password to log in to the BigFix console.
• The license.pvk file is not used to authenticate the BigFix LDAP operators, who are the local operators that are authenticated by an external LDAP server. They use their LDAP credentials to log in to the BigFix console. References:
• Managing licenses
• Missing or Lost license.pvk file
• Check private key password - license.pvk

• A Multiple Action Group is a way to deploy a set of Fixlets or tasks in a single grouping using the Take multiple actions command1.
• As a requirement, each Fixlet or task involved in the group must have associated a default action1.
• A default action is an action script that is predefined by the Fixlet or task author and can be executed without any user input2.
• If one or more of the Fixlets that are selected do not have a default action, the Take multiple actions command will fail and display an error in the Console1.
• To resolve this issue, the operator can either select only Fixlets or tasks that have default actions, or create a Baseline that includes the Fixlets or tasks without default actions1. References:
• 1: Taking multiple actions
• 2: Action Script
• 3: Take multiple actions
• 4: Action Script Guide

• The BES Client Usage Profiler is a tool that collects information about the client evaluation cycle, such as the average, maximum, and minimum duration, and the percentage of time spent on different tasks, such as action, api, archive, gather, etc.1
• To enable the BES Client Usage Profiler, you need to run the task 361 TROUBLESHOOTING: Enable BES Client Usage Profiler on the target clients. This task will set the _BESClient_UsageProfiler_Enable client setting to 1 and restart the client service.2
• After the task is completed, you can use the analysis 362 TROUBLESHOOTING: BES Client Usage Profiler to view the results of the profiler. This analysis will show you the evaluation cycle statistics and the breakdown of the time spent on each task.3
• You can use this information to identify any potential issues or bottlenecks in the client evaluation cycle, such as long action duration, high api percent, or excessive gather time. You can also compare the results with other clients or the average values to see if there are any anomalies or outliers.4
• To disable the BES Client Usage Profiler, you need to run the task 363 TROUBLESHOOTING: Disable BES Client Usage Profiler on the target clients. This task will set the _BESClient_UsageProfiler_Enable client setting to 0 and restart the client service.

References:

• 1: evaluation cycle | BigFix Developer
• 2: https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Config/c_usage_profiler.html
• 3: https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Config/r_usage_profiler_analysis.html
• 4: https://forum.bigfix.com/t/an-overview-on-the-client-evaluation-cycle/28056

• If UDP is not allowed on a network segment, the BigFix clients on that segment will not receive the UDP notifications from the server or relay, and will rely on the default 45-minute polling interval to check for new actions.1
• To reduce the delay in receiving new actions, you can enable the client polling feature, which allows the clients to poll the server or relay more frequently for new commands.2
• To enable the client polling feature, you need to set two client settings on the target clients:2
• You can set these client settings either through the console or manually on the endpoint.4
• After setting these client settings, the clients will poll the server or relay at the specified interval and receive new actions faster.

References:

• 1: https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Installation/c_sample_proxy_configurations.html
• 2: https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Config/r_client_set.html#_BESClient_Comm_CommandPollEnable
• 3: https://forum.bigfix.com/t/an-overview-on-the-client-evaluation-cycle/28056
• 4: https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Config/r_client_set.html#Making_a_configuration_setting

• Domains are a major organizing principle in the BigFix Console that allow you to access and manage related sites, such as Patch Management, AntiVirus Management, Power Management, and so on.
• Domains are not collections of Fixlet messages, but rather contain a set of related sites that have Fixlet messages, tasks, analyses, and other content. The content is created by HCL, other vendors, or yourself, depending on the site type and subscription.
• Domains do not provide a way to deploy actions across the network, but rather help you to find and select the relevant content for your actions. You can still use the Action Wizard or the Take Action button to deploy actions from any domain or site.
• Domains are located in the lower-left portion of the Console, where you can select the domain you want from the buttons at the bottom of the panel. The contents of the domain are then displayed in the upper-right panel, where you can filter and sort them by various criteria.
• Domains are not located under Tools in the Console, but rather under the Sites node in the navigation tree. You can also access the Manage Domains dialog from the Tools menu, where you can create, edit, or delete domains. References:
• Domains
• Introducing Domains
• Manage Domains

• The Fixlet Updated Windows Installation Folders - BigFix version 10 0 8 Nov; Available! is a special Fixlet that is released by HCL when a new version of the BigFix platform is available1.
• This Fixlet allows the administrator to update the BigFix installers that were created by the Installation Generator during the initial BigFix Server installation1.
• The administrator can use the BigFix console to take action on this Fixlet and target the BigFix Server computer1.
• The action will download the latest version of the BigFix installers from the License Download portal and replace the existing files on the BigFix Server1.
• This way, the administrator can ensure that the BigFix installers are always up to date and ready to be used for upgrading or installing other BigFix components1. References:
• 1: Upgrading the BigFix platform using Fixlets
• 2: BigFix Download Center

• BigFix Clients use UDP (User Datagram Protocol) to automatically find their closest relay based on network hops12.
• UDP is a connectionless protocol that does not guarantee reliable delivery of packets, but is faster and more efficient than TCP (Transmission Control Protocol)3.
• BigFix Clients send UDP packets to the BigFix Server and all the BigFix Relays in their subnet, and wait for responses12.
• The BigFix Server and the BigFix Relays reply with UDP packets containing their relay information and the number of hops to reach them12.
• The BigFix Client compares the responses and selects the relay with the lowest number of hops as its closest relay12.
• If the BigFix Client does not receive any response within a timeout period, it assumes that there is no relay in its subnet and falls back to the BigFix Server12. References:
• Automatically assigning relays to existing clients
• Configuring BigFix for automatic Relay selection Blog
• UDP (User Datagram Protocol)

• A Manual Computer Group is a group that is defined by manually selecting the computers from the Computers List Panel1. A Manual Group can only be shared between Master Operators2.
• An Automatic Computer Group is a group that is defined by using Relevance expressions or properties to indicate the group membership3. An Automatic Group can change its population dynamically depending on the evaluation of the group properties3.
• An operator might create a Manual Computer Group instead of an Automatic Computer Group if they need to base the group membership on information that is not available using Relevance expressions or properties. For example, if the operator wants to group computers based on their physical location, owner, or usage, they might not be able to use Relevance expressions or properties to determine that information. In that case, they can manually select the computers that belong to the group4.
• However, Manual Groups have some drawbacks, such as being static, not scalable, and not extensible5. Therefore, it is recommended to use Automatic Groups whenever possible and use Manual Groups sparingly25. References:
• Manual Computer Groups - HCL Product Documentation
• Manual Groups vs Automatic - Platform - BigFix Forum
• Creating Automatic Computer Groups - HCL Product Documentation
• Task or Fixlet to move computers into manual group - BigFix Forum
• Regarding Manual Computer Groups - BigFix Forum

To upgrade a stand-alone WebUI server, the following steps are required:

• Copy the BigFix WebUI installer (default location is %PROGRAM FILES%\BigFix Enterprise\BES Installers\WebUI) to the client computer that is running the BigFix WebUI.
• Stop the WebUI service.
• Run the installer on the computer that is running the WebUI. The installer detects the WebUI and offers to upgrade it for you. Follow the installer instructions to upgrade the BigFix WebUI.
• Start the WebUI service.

References:

• Upgrading the WebUI
• Stand-alone Web Reports upgrade? - Platform - BigFix Forum