Troubleshooting Inventory issues

There are several methods to troubleshoot inventory issues in your environment.

For details about Minimum Data Collection to troubleshoot Trellix Application and Change Control, see KB90755.

Perform the steps in this section if you are experiencing issues with Inventory not present:

Verify whether you have modified the Pull Complete Inventory Interval value in the Application Control Options policy. Adjust the timing accordingly. Rerun the Inventory Pull task if it fails.

Make sure ePO - On-prem server services are running.
Make sure that the client is solidified.
Verify inventory fetch time (Last and Next).
If inventory time is greater than 7 days, rerun the Pull task.
If the inventory time is less than 7 days, reset the inventory collection timestamps on the client.
You can run commands using the local TACC CLI or the ePO client task (SC: Run Commands).
Before running tasks from ePO - On-prem, ensure the TACC CLI is in the LOCKDOWN state. You can verify this by checking the Local CLI access property in the Solidcore product properties for the endpoint; it must be set to Restricted.
Run these commands to reset the last inventory sync time on the client:
- ```
sadmin config set InvDiffLastAccessTime=default
			 
```
- ```
sadmin config set PullInvLastAccessTime=default
			 
```
Note
The TACC inventory pull policy has a default interval of 7 days. This is configured in the Solidcore 8.x.x → Application Control → Application Control Options (Windows) → Pull Complete Inventory Interval setting. You can change this value. However, setting a low interval can cause performance issues when inventory is pulled frequently from many systems. Consider increasing this value as the number of managed systems grows.
On the TACC client, pull the inventory manually by running the following command: sadmin ls -rax > FILENAME.xml
Log in to the ePO - On-prem console.
Select Menu → Systems → System Tree.
Locate and select the specific endpoint that matches the System Name where you generated the FILENAME.xml file.
Note
Make sure you have selected the correct System Name. If you select an incorrect system, the inventory is imported to the wrong managed system.
Select Actions → Application Control → Import Inventory.
In the Choose File section, browse to and select the FILENAME.xml file generated on the TACC client, then click OK.
Confirm that the ePO - On-prem console displays the message: Inventory imported successfully.
Wait several minutes for the inventory import to complete.
Verify the import by checking the ePO - On-prem Audit Log for the Import inventory action status.
If rerunning the inventory pull task does not collect client inventory or display it in the ePO - On-prem console, collect the following information for further analysis:
- FILENAME.XML
- MER and Gatherinfo from the affected endpoint
- MER from the ePO - On-prem server with Orion debug logging enabled (See KB52369)

For details about Application Control command to reset throttling of events, policy discovery requests (observations), and inventory updates, see KB84348.

To reset the inventory-diff threshold on the endpoint, run the command sadmin reset-inv-diff-throttle. Inventory diff generation resumes on the endpoint after executing this command.

For details about Application Control Pull Inventory client task overview, see KB84247.

For details about Application Control corrupt inventory fallback process, see KB88222.

How to clear inventory time stamp

On ePO - On-prem:

Create SC: Run the following commands

 config set InvDiffLastAccessTime=default

config set PullInvLastAccessTime=default

Send the task to the client.

On Client:

Open Command Prompt with administrator's rights.
Recover the local CLI by executing sadmin recover. A password is needed to unlock the local CLI.

Run the following commands:

 sadmin config set InvDiffLastAccessTime=default

sadmin config set PullInvLastAccessTime=default