Troubleshooting BigFix

So, BigFix is installed but not reporting. What do you do now?

Before you begin...

Did you fully read the installation directions? Seriously. There are certain files that must be in certain places for the installation to work. You must also be on the Duke Network for the initial installation so that the agent can grab an encryption key from a non-Internet accessible server on-campus. It may be that all you need to do is re-read the directions, get on the VPN, and try again.

Also, have you restarted the computer? Seriously. You're welcome to start going through the information below, but a quick restart may also fix the issue.

With those basics out of the way...

First - Is the software actually there?

Running an installer doesn't always mean that the install actually worked! Check the appropriate location for your OS to ensure the installer performed as expected:

• Windows: C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe
• macOS: /Library/BESAgent/BESAgent.app
            (or, more fully, /Library/BESAgent/BESAgent.app/Contents/MacOS/BESAgent)

Second - Is the BigFix Masthead in place?

Without a Masthead file, the BigFix software can't know where the server is in order to report to it. Check the appropriate location for your OS to ensure a Masthead file is present:

• Windows: C:\Program Files (x86)\BigFix Enterprise\BES Client\ActionSite.afxm
• macOS: /Library/Application Support/BigFix/BES Agent/actionsite.afxm

Opening the Masthead file in a text editor and looking for the X-Fixlet-Site-Report-URL setting will tell you what server your client is attempting to report to:

• http://bf01.aas.duke.edu:52311 is the Duke University production instance

Third - Is the software running?

Using the command line or a GUI utility, look for a running BigFix process.

• Windows: Run "sc.exe query besclient"
  Sample output:
  SERVICE_NAME: besclient
  TYPE : 10 WIN32_OWN_PROCESS
  STATE : 4 RUNNING
  (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
  WIN32_EXIT_CODE : 0 (0x0)
  SERVICE_EXIT_CODE : 0 (0x0)
  CHECKPOINT : 0x0
  WAIT_HINT : 0x0
  
• Windows: Check Services for "BES Client"
  
  
• macOS: Run ps -ef | grep '[B]ESAgent' in Terminal
  Sample output:
      0   296     1   0  4Dec23 ??         4:12.70 /Library/BESAgent/BESAgent.app/Contents/MacOS/BESAgent -noservice
  501   603     1   0  4Dec23 ??         0:14.92 /Library/BESAgent/BESAgent.app/Contents/MacOS/BESClientUI.app/Contents/MacOS/BESClientUI ... If the command returns nothing, BigFix is not running.
  
  
• macOS: Check Activity Monitor for "BESAgent"

Fourth - What's the latest logfile look like?

BigFix log files are named by date: YYYYMMDD.log. Look at the end of the latest file for clues...

• Windows: C:\Program Files (x86)\BigFix Enterprise\BES Client\__BESData\__Global\Logs
• macOS: /Library/Application Support/BigFix/BES Agent/__BESData/__Global/Logs

If there are log files there but the latest one is from when you installed, this is an issue where restarting probably would have fixed it. Aren't you glad you went through all this instead?

If there is a current log file, common issues revealed in the log include:

• being unable to retrieve a client certificate due to not being on the Duke network at installation time (see "Before you begin..." above).
• the client having an expired certificate, requiring a full uninstallation using the BESRemove tool, available from https://duke.box.com/v/BigFixSoftware 

If you can't get anything useful from the log file, try contacting the appropriate support group in ServiceNow with the last 10 or 20 lines of the log file, "Device Engineering - OIT" for Duke University clients.

Extra: Alternative to restarting

Instead of restarting your computer, you can also restart the service:

• macOS: unload and reload the LaunchDaemon in Terminal:
  % sudo launchctl unload /Library/LaunchDaemons/BESAgentDaemon.plist
  % sudo launchctl load /Library/LaunchDaemons/BESAgentDaemon.plist
  
  
• Windows: Restart the BESAgent service in an Administrative PowerShell or CMD window:
  > net stop besclient
  > net start besclient
  OR restart the "BES Client" service in Services.