Azure Resource Query - Import Assets

[Jim]

Hi, 

 

We have successfully got our servers updating in Hornbill from Azure Arc, Is there any information on how we can update the software inventory for the servers or refer to a defined query in Log Analytics Workspace at all?

[Jim]

Any info on this at all? our infra team would really like to see the installed software from within Hornbill also

[Ricky]

Hi @Jim,

My Apologies for the delayed response. Neither MS Intune nor MS Arc Imports Tools can retrieve installed software details from Azure. This is due to performance reasons related to how this information would need to be accessed due to a lack of a suitable Microsoft API. During a conversation with the Integration Developers team, I was informed that Microsoft recently provided a new API that may be able to resolve the issue. However, this new API is only available for Intune; there does not look to be an equivalent for MS Arc at the moment, and therefore, until a better method is available, hands are currently tied. 

Our development team will be looking out for any further developments in alternative methods if possible, and once available, will be looking to update the tools accordingly. One thing that would be useful to the team in order for them to calculate the potential load, is if you could provide the following details:

1. The approximate number of Detected Applications.
2. The number of Managed Devices

 

 

 

[philip ross]

About 4,000 endpoints and 180,000 rows for installed applications. We previously did this via KACE.

[Ricky]

@Jim @philip ross, Apologies for the delay in responding. Our development team has made some progress with efficiently retrieving installed software via the Intunde data import tool. I'm not 100% sure if this is possible via MS Arc. I will look for further details and provide an update later today.

[Jim]

Do we know how this is possible for Virtual machines without ARC, I'm finding in a resource query that the information is in different tables, so for some I can use this query in Resource explorer to pull back the data I need, How would I put this into the json config?

 

Resources    

    | where type =~ 'microsoft.compute/virtualmachines'

    | project vmId = tolower(tostring(id)), vmName = name

    | join kind=leftouter   (Resources

        | where type =~ 'microsoft.network/networkinterfaces'

        | mv-expand ipconfig=properties.ipConfigurations

        | project vmId = tolower(tostring(properties.virtualMachine.id)), privateIp = ipconfig.properties.privateIPAddress, publicIpId = tostring(ipconfig.properties.publicIPAddress.id)

        | join kind=leftouter (Resources

            | where type =~ 'microsoft.network/publicipaddresses'

            | project publicIpId = id, publicIp = properties.ipAddress

        ) on publicIpId

        | project-away publicIpId, publicIpId1

        | summarize privateIps = make_list(privateIp), publicIps = make_list(publicIp) by vmId

    ) on vmId

    | project-away vmId1

    | sort by vmName asc

 

[Ricky]

Hi @Jim, will need to take a look at this in more detail and get back to you, I know that we have recently made changes to the Arc import regarding the inclusion of software inventory, but I am not sure what is possible for devices that do not have ARC and what is possible.

[Steve G]

Hi @Jim,

The Asset Import Utility now supports the pull of Software Inventory records for assets in Arc, as of v4.9.0: 

Cheers,

Steve 

[Jim]

Hi, 

 

I have updated our import and all I get even though there is definitely changes is the following, and some don't have any software listed, I wonder if I am doing something wrong? I haven't changed anything from the template for this and just added the keysafe keys and workspace id's etc, I have access in azure via the UI so its not permissions issue

2024/06/18 11:58:39 [AzureArc] Running Log Analytics query for software against  asset. Please wait...
2024/06/18 11:58:39 [DEBUG] Asset match found, no software inventory updates required

[Jim]

Currently looking at virtual machines and importing the installed software again, I am able to retrieve the software and view it in the log file, however it states Failed on software - 

2024/08/22 11:03:12 [DEBUG] 3194 Software Inventory Records processing...

2024/08/22 11:03:13 -=- Software Inventory Records -=-
2024/08/22 11:03:13  * Created: 0
2024/08/22 11:03:13  * Skipped: 0
2024/08/22 11:03:13  * Failed: 1
2024/08/22 11:03:13  * Removed: 0
2024/08/22 11:03:13  * Removal Failed: 0

 

3194 seems very high! any advice on why this is failing though?

 

 

[philip ross]

I have just gone back to this.

In the JSON file I added in the 

 

        "ImportDetectedApps": true

then ran an import. I am only interested in the APPs and it seems to read the data fine... but fails to then write it.
2024/12/06 13:27:13 [DEBUG] Asset record updated successfully: 63793
2024/12/06 13:27:13 [DEBUG] Asset record extended details updated successfully: 63793
2024/12/06 13:27:13 [DEBUG] Asset Last Updated date & user updated successfully: 63793
2024/12/06 13:27:13 [DEBUG] Processing Software Inventory updates for asset: 63793
2024/12/06 13:27:13 [DEBUG] 0 software records cached from Hornbill for Asset ID 63793
2024/12/06 13:27:13 [DEBUG] 130 Software Inventory Records processing...

....

<h_fk_asset_id>63793</h_fk_asset_id></record></primaryEntityData></recordData><recordData><primaryEntityData><record><h_fk_asset_id>63793</h_fk_asset_id></record></primaryEntityData></recordData><recordData><primaryEntityData><record><h_fk_asset_id>63793</h_fk_asset_id></record></primaryEntityData></recordData><recordData><primaryEntityData><record><h_fk_asset_id>63793</h_fk_asset_id></record></primaryEntityData></recordData><recordData><primaryEntityData><record><h_fk_asset_id>63793</h_fk_asset_id></record></primaryEntityData></recordData><recordData><primaryEntityData><record><h_fk_asset_id>63793</h_fk_asset_id></record></primaryEntityData></recordData><recordData><primaryEntityData><record><h_fk_asset_id>63793</h_fk_asset_id></record></primaryEntityData></recordData><recordData><primaryEntityData><record><h_fk_asset_id>63793</h_fk_asset_id></record></primaryEntityData></recordData><recordData><primaryEntityData><record><h_fk_asset_id>63793</h_fk_asset_id></record></primaryEntityData></recordData></params>
2024/12/06 13:27:13 [ERROR] Error creating software records for [63793]: Unable to create software inventory records: A database or query error occurred while inserting the primary record data into the database. (table=h_cmdb_assets_installed_software, pk=)
2024/12/06 13:27:13 -=-=-= Summary =-=-=-
 

Is there a setting I am missing or something? This is on our test version