3 Replies Latest reply on Mar 10, 2014 10:08 AM by Lawrence Garvin

    Getting the date/time an update was downloaded/installed

    dkeyser

      Hello again all,

       

      I'm working on a report that requires the date/time that a patch was downloaded and if it was installed then date/time as well. Not seeing this as a selectable category so I figured I'd ask the experts if this is something doable.

        • Re: Getting the date/time an update was downloaded/installed
          Lawrence Garvin

          If the patch was downloaded/installed as a result of a Patch Manager Update Management (or Update Management Wizard) task, then the download time and installation time will be recorded in the Task Details History for that task.

           

          If the patch was downloaded/installed by the Windows Update Agent as part of a regular event cycle, that event data is reported to the WSUS server, but it is transient. It can be viewed on the "Update Events" tab of the WSUS node of the console for an indeterminate and variable period of time after the event, and can be exported from that display. However, download events are notorious for rapidly disappearing after installation events have been reported.

           

          Additionally, the download and installation events are recorded in the client's Application Event Log (also transient though) and permanently in the ReportingEvents.log which is found in the %windir%\SoftwareDistribution folder. The WUA events recorded in the Application Event Log can be inventoried via the Managed Computer Inventory task using the Windows Update -> Event Log option (which is disabled by default). Note, though, that the Managed Computer Inventory only takes what is currently in the event log; there is no historical storage of event log data in the Patch Manager server. There is no capability for remote access to the ReportingEvents.log.

          • Re: Getting the date/time an update was downloaded/installed
            dkeyser

            I want to make sure I'm understanding this:

             

            1) If we are to create a report that shows the date/time of a patch being installed by target machines we'd have to enable the Event Log inventory task.

             

            2) Then run an inventory task right after the patching to grab the even log you're speaking of.

             

            3)  Finally we'll need to generate a report using that data to save the results as they are not kept in the management database at all.

             

            I'm having an issue getting the Event Log(Windows Update and update Services Server Events) and Windows Update Agent Log check boxes to stay selected. Every time I open the Inventory Configuration Editor these are reset to default.

             

            Also what category in the report creator would I be able to access this data? I'm assuming under configuration management reports but I'm not seeing anything that slaps me in the face as update service events.

             

              • Re: Getting the date/time an update was downloaded/installed
                Lawrence Garvin

                I want to make sure I'm understanding this:

                1) If we are to create a report that shows the date/time of a patch being installed by target machines we'd have to enable the Event Log inventory task.

                2) Then run an inventory task right after the patching to grab the even log you're speaking of.

                3)  Finally we'll need to generate a report using that data to save the results

                This part is correct.

                as they are not kept in the management database at all.

                This part may not be, depending on what you mean. The data you collect from an inventory is kept in the Patch Manager database until the next inventory task is performed. Then, it is overwritten by whatever inventory data is collected from the client during the next inventory. Because the Event Logs on a Windows system contain transient data, it is quite possible that Event Log items collected during one inventory will be "removed" (due to their absence) when a subsequent inventory is performed.

                I'm having an issue getting the Event Log(Windows Update and update Services Server Events) and Windows Update Agent Log check boxes to stay selected. Every time I open the Inventory Configuration Editor these are reset to default.

                When you open the Inventory Configuration Editor, it loads the "Default" template. You need to SAVE a user-defined template with those options selected, then LOAD that user-defined template when you load the Inventory Configuration Editor. (Note, you do not need the WindowsUpdate.log option for the reporting objective you've described.)

                 

                You might also consider this: Rather than adding these options to your regular inventory task, create an inventory task with ONLY the 'Event Log' option selected, and only run that inventory task when you need to refresh the Event Log data stored in the Patch Manager server.