CI software version whitelist

[thuliogh]

Hi, I have a request from my manager to create a report and highlight the software that is outdated.

We have Discovery running regularly so our computers are being stored as CIs and the software is being populated as Software Packages (cmdb_ci_spkg). Each software has a version column.

Is there a way to set a minimum accepted version?

For example, by searching the Java installations:

I would like to set 8.0.4 as the minimum allowed, so the report would return all the versions that are older than 8.0.4

Is SAM a required software to achieve that?

[Community Alums · Accepted solution]

You don't need SAM (Software Asset Management) for this, though SAM would definitely make this kind of reporting and management much easier and more automated. You can achieve this with a combination of reporting and potentially some scripting, but it will be more manual without SAM.

Here's how you can approach it without SAM:

1. Create a Report:

   • Go to Reports > Create New.
   • Choose a table: cmdb_ci_computer (since you want to report on computers with outdated software).
   • Add a filter:
     • "Related Lists" > "Software Packages [cmdb_ci_spkg]" > "Version" "is less than" "8.0.4" (or your desired minimum version). This is the key filter.
   • Add columns: Include relevant information in your report, such as:
     • Computer Name (from the cmdb_ci_computer table)
     • Software Name (from the cmdb_ci_spkg related list)
     • Version (from the cmdb_ci_spkg related list)
     • Operating System (from the cmdb_ci_computer table - optional, but helpful)
   • Run the report: This should give you a list of computers with Java versions older than 8.0.4.

2. Handling Different Software:

   • The above method works well for one specific software (like Java in your example). To report on all outdated software, you'll need a way to define the minimum acceptable version for each software. Without SAM, this is where it gets more complex.

3. Manual Minimum Version Tracking (Without SAM):

   • Custom Table (Simplest): Create a custom table (e.g., u_software_versions) with fields like:
     • Software Name
     • Minimum Acceptable Version
   • Populate this table with the minimum versions for all the software you want to track.
   • Enhance the Report (Scripting Required): You'll need to use a script in your report to:
     • Look up the "Software Name" in your cmdb_ci_spkg records.
     • Query your custom u_software_versions table to get the corresponding "Minimum Acceptable Version."
     • Compare the installed version with the minimum acceptable version.
     • Only include software in the report if it's outdated. This requires scripting in the report's filter or data source.

4. Scheduled Reports:

   • Once you have your report working, you can schedule it to run regularly (e.g., weekly or monthly) and have it emailed to you or your manager.

Why SAM is Better:

SAM automates the entire process. It has built-in features for:

• Defining software lifecycles: You can set end-of-life dates and minimum versions for software.
• Automated reporting: SAM provides out-of-the-box reports on outdated software.
• License management: SAM helps you track software licenses and ensure compliance.

While you can achieve your basic reporting needs without SAM, it will require more manual effort and scripting, especially if you need to track many different software titles and their minimum versions. If outdated software reporting is a regular requirement, SAM is a worthwhile investment.

[thuliogh]

Thank you for your explanation.

I am trying to implement the scripted part, but maybe I'm doing something wrong.

I created the new table called x_xxx_softw_versn_software_version and saved 2 softwares with name and minimal accepted version.

After that, I changed to scope to global and created a Script Include to query this new table, get the software names on it and use it to find matches (name match) on the cmdb_ci_spkg table.

var SoftwareVersion = Class.create();
SoftwareVersion.prototype = Object.extendsObject(global.AbstractAjaxProcessor, {

    getSoftwareList: function() {
        var monitoredSoftware = [];
        var gr = new GlideRecord('x_xxx_softw_versn_software_version');
        gr.addQuery('active', true);
        gr.query();

        while (gr.next()) {
            monitoredSoftware.push(gr.software_name.toString().toLocaleLowerCase());
        }

        return monitoredSoftware;
    },

    getOutdatedSoftware: function() {
        var monitoredSoftware = this.getSoftwareList();
        var pkgIds = [];
        var gr = new GlideRecord('cmdb_ci_spkg');

        gr.addQuery('install_count', '>', 0);

        var namedQuery = monitoredSoftware.map(function(appName) {
            return 'nameLIKE' + appName;
        }).join("^OR");

        gr.addQuery(namedQuery);
        gr.query();

        while (gr.next()) {
            pkgIds.push(gr.sys_id.toString());
        }

        return pkgIds;
    },
    type: 'SoftwareVersion'
});

When I execute gs.debug(new SoftwareVersion().getOutdatedSoftware()) in the sys.scripts.do screen 

I receive 20 IDs, but when I use it in the filter, it returns NULL.

I also tried javascript: new SoftwareVersion().getOutdatedSoftware();

What am I doing wrong?

I am first trying to filter the results and once it works I will create a comparison for the versions.

[thuliogh]

I fixed the issue.
I searched the logs and there was a warning like this:

<span>
Not allowing access to script include rhino.sandbox.SoftwareVersion
Script include is not callable from the sandbox: no thrown error
</span>

So, I checked the Sandbox enabled flag and it returned the IDs.

Also, this is the final version of the script:

var SoftwareVersion = Class.create();
SoftwareVersion.prototype = Object.extendsObject(global.AbstractAjaxProcessor, {

    getSoftwareList: function() {
        var monitoredSoftware = {};
        var gr = new GlideRecord('x_xxx_softw_versn_software_version');
        gr.addQuery('active', true);
        gr.query();

        while (gr.next()) {
            monitoredSoftware[gr.software_name.toString().toLocaleLowerCase()] = gr.minimum_acceptable_version.getValue();
        }

        return monitoredSoftware;
    },

    getOutdatedSoftware: function() {
        var monitoredSoftware = this.getSoftwareList();
        var pkgIds = [];
        var gr = new GlideRecord('cmdb_ci_spkg');

        gr.addQuery('install_count', '>', 0);

        var namedQuery = Object.keys(monitoredSoftware).map(function(appName) {
            return 'nameLIKE' + appName;
        }).join("^OR");

        gr.addQuery(namedQuery);
        gr.query();

        while (gr.next()) {
            if (this.isVersionLessThan(gr.version.getValue(), monitoredSoftware[gr.name.toString().toLocaleLowerCase()])) {
                pkgIds.push(gr.sys_id.toString());
            }
        }

        return pkgIds;
    },

    compareVersion: function(a, b) {
        var i, cmp, len;
        a = (a + '').split('.');
        b = (b + '').split('.');
        len = Math.max(a.length, b.length);
        for (i = 0; i < len; i++) {
            if (a[i] === undefined) {
                a[i] = '0';
            }
            if (b[i] === undefined) {
                b[i] = '0';
            }
            cmp = parseInt(a[i], 10) - parseInt(b[i], 10);
            if (cmp !== 0) {
                return (cmp < 0 ? -1 : 1);
            }
        }
        return 0;
    },

    isVersionGreaterThanOrEqual: function(a, b) {
        return this.compareVersion(a, b) >= 0;
    },

    isVersionLessThan: function(a, b) {
        return this.compareVersion(a, b) < 0;
    },

    type: 'SoftwareVersion'
});

I will create the reports now that the filter is returning the contents I need.

Thank you for your support @Community Alums and for spending your time to guide me to the expected result!