ALTIRIS Software State Management

Transcription

1 ALTIRIS Software State Management The information contained in the Altiris Knowledgebase is subject to the Terms of Use as outlined at

2 History Additions / Edits Date 1st Draft 7/21/06 Final Draft 8/22/06 Dev Tech Edit 7/21/06 Copy Edit 8/22/06 Update 5/9/07 Software State Management 2

3 Introduction After you install a software package on a collection of computers, changes in a computer s environment can adversely affect the state of that package (example: the removal of another application that removes a file required by the package). This can lead to application failures, help-desk incidents, disgruntled employees, and costly maintenance. Software state management is an automated and proactive means of addressing this problem. When the Altiris Notification Server software and Wise Package Studio Professional Edition are integrated, you can manage the state of a package by simply configuring and enabling a task that is created for the package. All the required state management functionality is built into the task. Use software state management to: Evaluate the state of installed packages Software state management uses tasks to systematically and selectively evaluate the state of software packages on collections of computers. These tasks use rules that check specific data about a package instead of checking for every file and registry key. Because these rules are dynamically linked to the source package, they use the source package s current data to evaluate the state of an installed package. When the data in the source package changes, you don t have to manually update the rule. It is updated automatically because of the dynamic link. Remediate packages that are not in the desired state If a software state management task evaluates a package on a computer and determines that it is out of compliance, it can automatically perform remediation to restore the package to its desired state. Topics include: Software State Management Automation Software State Management Setup (page 4) Software State Management Process (page 5) Advanced Options for Software State Management (page 8) Software State Management Automation Software state management integrates the tools and resources of Wise Package Studio with the capabilities of the Notification Server. Because of this integration, the process of managing the state of an installed package on a collection of computers is highly automated. All you have to do is configure and enable a task that is created for the package. The software state management process can automate the following: The creation of package management tasks Software state management creates package management tasks to evaluate the state of installed packages and, if needed, to perform remediation. When a package management task is created, it contains a rule that performs the evaluation. This rule is based on specific package data (example: files, registry keys, product code). Because this rule is automatically created with the task, you don t have to acquire an in-depth understanding of the package s data to create the rule. Software State Management 3

4 The evaluation of installed packages at specified intervals After tasks are created, you configure and enable them. When you configure a task, you specify how often it should evaluate a package. After you enable a task, it performs the evaluation on a collection of computers at a specified interval. Evaluating packages at set intervals instead of waiting for others to report problems is a proactive approach to maintaining the desired state of a package. The remediation of packages that are out of compliance When a task evaluates a package and finds it out of compliance, it can perform remediation. This can resolve problems before they become apparent to the user and prevent costly help-desk incidents. Because remediation is automated, the need for human intervention is eliminated and maintenance costs are reduced. The updating of installed packages When you update a package in the Wise Software Repository (in Wise Package Studio), software state management can automatically update that package on the computers where it is installed. This is because the task that evaluates the installed package uses smart rules. A smart rule accesses the current data for a package in the repository and uses this information to evaluate the state of installed packages. Because smart rules are updated automatically, you can be confident that your end users will have the latest packages. Example: You deployed a package that has 5.DLL files on a collection of computers. This package has a package management task that contains a smart rule that checks for the correct.dll files in the installed package. You now update the package in the Wise Software Repository (in Wise Package Studio) with one that has 6.DLL files. The next time the task evaluates the installed packages, it finds them out of compliance because its smart rule knows that the package should have 6.DLL files. The task then performs remediation and installs the updated package on the collection of computers. Software State Management Setup To fully automate software state management, you must install the following software. This assumes that Notification Server 6.0 or later is installed and the Altiris Agent 6.0 or later is installed on the client computers. Altiris Application Management Solution software Install version 6.1 or later from the Solution Center in the Altiris Console. This also installs software dependencies that are not already installed (example: Package Rule Management). State Management Agent After you install Application Management Solution, install the State Management Agent on the collection of computers on which you will perform state management. The agent evaluates the state of packages on managed computers based on the rules specified in package management tasks. Application Management Solution contains a predefined policy for installing the State Management Agent on managed computers. For details, see the Application Management Solution Reference Guide. Wise Package Studio Professional Edition Install version 6.01 or later on a computer on your network. Wise Integration Component Install version 6.1 or later from the Solution Center in the Altiris Console. To locate this component in the Solution Center, click the Available Solutions tab, click Segments, and then expand the Components section. After you install the Wise Software State Management 4

5 Integration Component, configure the connection between the Notification Server and the Wise Software Repository on the Wise Software Repository page. For configuration details, see the Wise Integration Component Guide. If you do not have Wise Package Studio and Wise Integration Component, package management tasks are not created automatically. However, you can create and update them manually. For details, see the Application Management Help. In addition to the preceding software, which is required to fully automate the software state management process, you can also further enhance the software state management functionality if you have Altiris Software Delivery Solution software and Altiris Patch Management Solution software installed. For details, see Software State Management Process (page 5). Software State Management Process After you install the required software (see Software State Management Setup on page 4), you can begin the software state management process. Because this process is highly automated, it requires limited intervention on your part. However, you can also modify the process to expand its capabilities and meet your specific needs (see Advanced Options for Software State Management on page 8). Step 1: Create Managed Packages A managed package is any package in the Wise Software Repository (in Wise Package Studio) that has: Defined resources If a package s resources are included with a package, they are defined. A status of Available Packages are assigned a status in Software Manager. When a package has a status of Available, it is ready to be deployed. (See the Software Manager Help in Wise Package Studio.) A package definition. If a package is an.msi,.wse, or.vsa file, a package definition is not required because it will be created automatically when the package is imported. A managed package is managed by the Wise Integration Component, which integrates the repository with the Notification Server. A package management task is automatically created for every managed package (except for.vsa files and packages that require the Universal Import option to import them into the Wise Software Repository). In the Wise Software Repository, each package consists of a collection of resources (example: files, registry keys) and information about where each resource is installed. Software state management uses this data when it creates a task to evaluate the state of an installed package. To create managed packages, do any of the following: Enable bulletins in Patch Management Solution Patch Management Solution lets you download and distribute Microsoft security patches. These patches are downloaded in software bulletins. Each bulletin can consist of one or more patches. When you enable a bulletin in Patch Management Solution, its patches are automatically imported into the Wise Software Repository Software State Management 5

6 and given a status of Available if Software Manager (a tool in Wise Package Studio) can import it. It is then a managed package. For details about downloading patches, see the Patch Management Solution Help. Software Manager cannot automatically import a patch into the repository if its base.msi is not in the repository or if it is an.exe that Software Manager does not recognize as an importable package. If a patch cannot be imported automatically into the repository, you can still import it using the Universal Import option, but it will not be a managed package. For details, see the Software Manager Help in Wise Package Studio. Create packages in Software Delivery Solution Software Delivery Solution lets you create and deploy software delivery packages. When you create a software delivery package, it is automatically imported into the Wise Software Repository and given a status of Available if Software Manager (a tool in Wise Package Studio) recognizes it as an importable package. It is then a managed package. For details, see the Software Delivery Solution Help. If a software delivery package is not recognize as an importable package by Software Manager, you can still import it using the Universal Import option, but it will not be a managed package. For details, see the Software Manager Help in Wise Package Studio. Import a package into the Wise Software Repository and change its status to Available You can use Software Manager (a tool in Wise Package Studio) to import a package into the Wise Software Repository. This will probably be a package that you repackaged, edited, and tested in Wise Package Studio (see the Wise Package Studio Help). When you change the status of the package to Available in Software Manager, it becomes a managed package. For details, see the Software Manager Help in Wise Package Studio. If a package is not a managed package, you can still manage its state. However, you have to create and update its package management task manually. Step 2: Deploy the Managed Packages When a package becomes a managed package, it appears in the Available Packages folder in the Altiris Console. To access this folder, select the Resources tab (Altiris Console 6.0) or View > Resources (Altiris Console 6.5) and navigate to Resource Management > Resources > Software Management > Software Delivery Packages > Windows > Wise Integration Component. To deploy an available package, select Software Delivery Wizard from the folder s right-click menu. For details, see the Software Delivery Solution Help. If the package does not appear in the Available Packages folder, the package in the Wise Software Repository probably is not yet synchronized with the Notification Server. To synchronize the package manually, click the Run Now button on the Wise Software Repository page. The synchronization schedule is set by the Synchronize Packages policy. For details, see the Wise Integration Component Help. Software State Management 6

7 Step 3: Configure and Enable the Package Management Tasks A package management task is created automatically for every managed package (except for.vsa files and packages that require the Universal Import option to import them into the Wise Software Repository). To access the task, select the Tasks tab (Altiris Console 6.0) or View > Tasks (Altiris Console 6.5) and navigate to Tasks > Software Management > Application Management > Software State Management > Package Management Tasks > Wise Integration Component. If the package does not appear in the Available Packages folder, the package in the Wise Software Repository probably is not yet synchronized with the Notification Server. To synchronize the package manually, click the Run Now button on the Wise Software Repository page. The synchronization schedule is set by the Synchronize Packages policy. For details, see the Wise Integration Component Help. To manage the state of the package, you configure and enable the task. When you configure the task, you select a collection of computers to which it applies. You should also select the option to create a software delivery task to manage the state of the package. This delivery task performs the remediation if it is needed. When a package management task is created, it contains a package rule. The task uses this rule to evaluate the state of the package on the specified collection of computers. (For details on how the task performs the evaluation, see Software State Management Evaluation on page 7.) If the task finds that the package is out of compliance, it can perform remediation to restore the package to its desired state. (For details on how the task performs the remediation, see Software State Management Remediation on page 8.) Step 4: Run Software State Management Reports After you enable package management tasks, you can run reports to determine where managed packages are installed, which tasks and computers are out of compliance, and which computers have rerun remediation attempts. These reports are in the Software State Management folder in the Application Management reports. Also see Software State Management Automation (page 3). Software State Management Evaluation A package management task is created automatically for every managed package (except for.vsa files and packages that require the Universal Import option to import them into the Wise Software Repository). (For details about managed packages, see Step 1: Create Managed Packages on page 5.) Each task contains a package rule that evaluates the state of the package on a collection of computers. Because the package rule is dynamically linked to the managed package s data, it uses the most current data to perform the evaluation. (To edit a task s package rule or to add rules, see Adding or Editing Package Rules on page 9.) When a package management task is created, its package rule is defined by a package rule template. Any type of package that you can import into Wise Software Repository has its own default package rule template (except for.vsa files and packages that require the Universal Import option to import them into the Wise Software Repository). Each of these templates has a rule that contains at least one rule expression. The rule expressions check different package data (examples: registry values, product codes, or a file s existence). When a package management task evaluates a package, it uses these Software State Management 7

8 expressions to perform a selective evaluation. It does not have to check every file or registry key in a package to determine if the package is in its desired state. It merely checks the package data specified in the rule expression. To access the default package rule templates, select the Configuration tab (Altiris Console 6.0) or View > Configuration (Altiris Console 6.5) and navigate to Solution Settings > Software Management > Wise Integration Component > Package Rule Templates. If the default templates do not meet your specific needs, you can clone and edit them. See Creating Package Rule Templates (page 9). Example: Evaluation of an.msi package After you import an.msi package into the Wise Software Repository (in Wise Package Studio), you use Conflict Manager (a tool in Wise Package Studio) to detect and resolve conflicts between the.msi and other packages to avoid problems when you deploy the package. When the package is ready to deploy, you change its status to Available. It is now a managed package and a package management task is created for it. The package management task contains a package rule that was created by the Windows Installer Package Rule template. This package rule contains an expression that checks the package s product code (to see if the package is present) and another that checks its shortcut target. The package rule contains only these 2 expressions because Windows Installer packages (.MSIs) have self-repair capabilities that restore them to their desired state if the package and its shortcut are present. If the package or its shortcut are not present, the package rule evaluates the package as out of compliance and the task s remediation reinstalls the package. In other words, the package management task is designed to work with Windows Installer and performs remediation only when Windows Installer cannot perform self repair. Software State Management Remediation When a package management task is created for a package, the package s program includes a command line that is used to perform the remediation. To access this command line from a package management task, access the task s Advanced tab and click Go to program. The Command line field contains the default remediation method, which is to reinstall. Reinstallation is the default method of remediation because it executes the installation logic, which ensures that everything is installed. Reinstallation requires only minimal network traffic because Software Delivery reinstalls the application from a local cache directory. For information on modifying the default remediation method, see Modifying Remediation (page 10). Advanced Options for Software State Management When a package is a managed package (except for.vsa files and packages that require the Universal Import option to import them into the Wise Software Repository), you can enable software state management for that package simply by configuring and enabling its package management task (see Software State Management Process on page 5). You can also modify the process to expand its capabilities and meet your specific needs. Following are some of the modifications you can make: Create your own package rule templates. See Creating Package Rule Templates (page 9). Software State Management 8

9 Modify a package management task by editing its package rule or adding additional rules. See Adding or Editing Package Rules (page 9). Modify how a package management task performs remediation. See Modifying Remediation (page 10). Create software state management tasks that evaluate the state of a set of packages. See Creating State Management Tasks (page 11). You also can create tasks for unmanaged packages. For details, see the Application Management Help. Creating Package Rule Templates A package rule template defines the rule that is added to a package management task when it is created automatically. A default package rule template exists for each type of managed package (except for.vsa files and packages that require the Universal Import option to import them into the Wise Software Repository). To access the default package rule templates, select the Configuration tab (Altiris Console 6.0) or View > Configuration (Altiris Console 6.5) and navigate to Solution Settings > Software Management > Wise Integration Component > Package Rule Templates. You also can create or edit a template to meet your specific needs. To create a new template, select New > Package Rule Template from the Package Rule Templates rightclick menu. When you create a package rule template, you specify the type of managed package it applies to and you create a package rule. The package rule consists of at least one operator and one expression. You can also add prerequisite rules that let you specify the criteria that must be met before the package rule is evaluated. For details, see Package Rule Management Help. Recommendations Don t edit a default template. Instead, clone the template and then edit it. Don t edit the template for specific packages. If you need to check for specific resources in a package, clone its package management task and edit it to meet the specific requirements of that package. Example: If you need to check for unique registry keys to identify a specific edition of a product, don t put this in the template, but clone the package s package management task and add a rule to it. For details, see Adding or Editing Package Rules (page 9). Keep templates as simple as possible. Example: Don t add rule expressions that check for all files and registry keys. Use smart rule expressions. Smart rule expressions are dynamically linked to the managed package and update when the package s data change. Leave the fields in smart rule expressions blank. This creates a generic template that works for every package of that type. Create templates for internal applications for which you have detailed information. Adding or Editing Package Rules When a package management task is created automatically, it contains a package rule. If this package rule does not meet your needs, you can clone the task and then edit the rule or add additional rules. For the location of the package management tasks, see Step 3: Configure and Enable the Package Management Tasks (page 7). Software State Management 9

10 When you clone a package management task that was created automatically, any package rules that dynamically link to the package s data remain intact. However, the task is no longer dynamically linked to the package rule template that created it. If you change the template in the future, those changes will not appear in the task. To edit a package rule 1. From the task s right-click menu, select Clone. The cloned task is added to the Package Management Tasks\User Defined folder and appears in the right pane. 2. To edit a package rule, click at the beginning of the rule on the package management task. The Edit Rule dialog appears. On this dialog you can add and edit rule expressions and operators. You also can add prerequisite rules that let you specify the criteria that must be met before the package rule is evaluated. For details, see the Package Rule Management Help. To add a package rule 1. From the task s right-click menu, select Clone. The cloned task is added to the Package Management Tasks\User Defined folder and appears in the right pane. 2. To add a new package rule, click Create new. The Create Rule dialog appears. For details on creating a new rule, see the Package Rule Management Help. 3. To add an existing rule, click Add existing. a. On the Selector dialog, click to access the All Inventory Rules dialog. b. Select the rule. Click OK. c. On the Selector dialog, select the rule again. Click OK. Modifying Remediation When a package management task is created, it contains a command line that is used to perform remediation. For details, see Software State Management Remediation (page 8). You can edit this command line to modify how remediation is performed. Recommendations If you have a large package, you might create several tasks for the package. Each task could determine if a specific part of the package is in compliance. Then only those parts that fail would require remediation. If you have a very large package and if the package has a small number of executable files, you could create a WiseScript that runs from the command line and installs just the executable files. If you are checking registry keys only, use a WiseScript or registry file to remediate just the registry key rather than reinstalling all of the package s resources. Software State Management 10

11 To create a WiseScript, use WiseScript Package Editor or WiseScript Editor in Wise Package Studio. See the article Performing System Administration Tasks With WiseScripts in the Altiris Knowledgebase. Creating State Management Tasks In addition to package management tasks, you can create state management tasks. A state management task is a collection of package management tasks. Package management tasks evaluate and, if needed, remediate the state of a package on a collection of computers. State management tasks evaluate and, if needed, remediate the state of a set of packages on a collection of computers. While package management tasks are created automatically for every managed package (except for.vsa files and packages that require the Universal Import option to import them into the Wise Software Repository), you must create state management tasks manually. Recommendations Use state management tasks for a logical group of packages that are installed on a specific collection of computers. Example: The core applications for a particular department. A conflict can exist between a state management task and a package management task if each causes the other to perform remediation. (Example: If the state management task checks for a specific version of a.dll and the package management task checks for another version of the same.dll, then each task would cause the other to perform remediation.) To resolve this issue, schedule the higher priority task to continue to perform remediation after the lower priority task runs out of its allotted remediation attempts. You can do this by either scheduling the lower priority task to run more frequently or assigning it fewer successive remediation attempts. To create a state management task 1. From the Altiris Console, select the Tasks tab (Altiris Console 6.0) or View > Tasks (Altiris Console 6.5). 2. In the left pane, select Tasks > Software Management > Application Management > Software State Management > State Management Tasks. 3. From the right-click menu of State Management Tasks, select New > State Management Task. 4. Complete the State Management Task page. For details, see Configuring a State Management Task in the Application Management Help. Software State Management 11