Policy Results Report

Valerie

October 27, 2022 18:36

The Policy Results report allows you to view historical data for policy runs in a zone. You can see the success rates and understand which devices had failures so that you can take action. You can access this report by selecting Reports in the main console.

The following topics are described here:

Policy Results Overview
Policy Results Report Table
Status tiles: Legend
Filtering and Searching in the Policy Results Report
Policy Results Device Table
- Columns (Device Table)
- Device Table Details
Policy Run History
CSV Export
Caveats
Related Topics

See also Creating Reports and Data Extracts.

Policy Results Overview

The policy results report lists the results for the last 400 days for all policy types (patch policies, required software policies, and worklets). Results are shown in a table with status bars.

Note: Historical data in this report does not pre-date March 1, 2024.

Note: You can use the Export CSV button to export this report.

Policy Results Report Table

From the Reports page, click View for the Policy Results Report.

The following information is available from the policy results report table.

Column	Description
Actions	Possible options: Run policy View policy View device table View policy history
Run Time	This shows the date and time of when the last run was started for this policy. Click this timestamp to open the Device Table.
Devices	This lists the number of devices that were associated with the policy during the run.
Policy Name	Click the policy name to open the Policy Run History. The current name of the policy is shown with historical information for that policy even if the policy has been renamed. If a policy is deleted, that will be indicated. The most current name of that policy is used.
Results	This visualization provides at a glance results for this policy. Hover over the bar to view details.

Status tiles: Legend

You can identify the status of the most recent policy runs by reviewing the status tiles. Use these as a reference for the filters and report details. This legend is hidden by default. Click the arrow to show or hide the details.

Status tile name	Description
Successful	The policy successfully ran on the device.
Pending	The device was reached, but the policy has not run yet. Check back later to see an updated result.
Failed	An error occurred when attempting to run the policy on the device. You can view the reason for the failure within the report.
Remediation Not Applicable	The device was evaluated and no action is required. The device was already up to date with the policy. Specifically, the device was scanned and no remediation is necessary.
Not Included	The device was not included in this policy run because it was disconnected or filtered out as a result of, for example, device targeting.

Filtering and Searching in the Policy Results Report

The filter panel is made up of different types of options to fine-tune your report. You can filter the list of policy runs by date range, results, policies, and display options. When you select any of the individual filters, the table automatically updates. You can clear selections individually or select Clear All.

You can hide or show the filter panel, as needed. The filter panel shows by default.

Date Range

You can filter the list of policy result runs by date.

Open the Date Range menu and select from the options:

Last 24 Hours
Last 48 Hours
Last 7 Days
Last 30 Days
Custom: Use the calendar options to create a custom search. For details, see Using the custom date calendar.

Using the custom date calendar

You can create a custom date search by using the calendar options.

Note:

Historical data is unavailable for dates prior to March 1, 2024. The collection of data is ongoing and when we reach 400 days, the oldest date is replaced with new data every 24 hours.
It is not possible to select more than 100 days at a time.

To use the custom calendar, click into the Start Date field. The calendar allows you to select the desired start date and time.
Use your mouse to select a time, or use the drop-down menu. You can tab to continue to the next field.
Select an end date and time. The format for dates are: MM-DD-YY (e.g. 02-14-23). Note: It is not possible to select more than 100 days at a time.

Results are immediately updated.

Status Results filter

You can filter the policy results report by the status results. You can select multiple policy status results to filter the list by. The corresponding view is updated immediately.

Policies

You can filter the policy results report by policy. The filter allows you to select by policy type and the individual corresponding policies in your zone.

Select Policy Type: Patch, Required Software, and Worklet.
Depending on the policy type or types you select, the Select Policy option shows the corresponding policy names that you can filter by.

Display Options

Use the Display Options filter to sort policy run results by policy name.

Select Group by policy.
- The list automatically groups all runs of a policy together. You can see how many times a policy ran for the date range selected.
Click the arrow in the Sort by filter.
- Sort by Policy name: The groups are in order by policy name
- Sort by Last run: The groups are in order by the most recent policy run
- Sort by Total runs: The groups are in order by the most runs per policy

You can switch between ascending and descending (default) order.

Search for a policy

You can narrow down data from the filtered search by using the search bar at the top of the table. This enhanced search allows multiple queries and partial matching.

If a policy is deleted, that will be indicated in the table. The most current name of that policy is used.

Show all columns of data

The default setting of the policy results report does not show all available columns. You can show more data or rearrange how the columns are presented.

Click the Columns button and select the checkboxes to show or hide columns.
You can rearrange the order of the data by dragging the column names to the desired position.

Policy Results Device Table

You can view details about a specific policy run. There are two ways to open the Device Table from the main policy results report.

From the Policy Results Report page, for a specific policy select Actions > View Device Table.
For a specific policy, go to the Run Time column and click the timestamp.

The Device Table opens as shown in this example.

Note: You will see no results for the following scenarios:

If all devices are offline when a scheduled policy runs.
If all devices are offline and a policy was manually triggered to run.
A scheduled policy ran, but it had no devices associated with it.
Currently, if a device was in a deferred state at the time the policy ran (either reboot or policy deferral), there will be no results. The Policy Results Report registers the total number of devices associated with a policy, however, the number of devices listed in the Device Table will not include any deferred devices.

Note: The report can show run results with devices marked as Not Included. This result comes from these possible causes, which are evaluated in the following order:

The device OS does not match the policy requirement.
The device was offline.
The device was filtered out by device targeting.

Column	Description
Device	Name of the device that is in the policy.
Result	Possible outcomes: Successful, Pending, Failed, Remediation Not Applicable, Not Included
Event Time	Time that the specific event was recorded.
Summary	Use the search box at the top to find logs for specific details listed in the Summary column such as package names and KBs.
Details	Click the down arrow for complete information about the logged activity.
Worklet Exit Code	The exit code is listed here, if available. This column is hidden by default.

From the Device Table, you can do the following:

Select a different run time. Go to the Run Time drop-down list and find the date and time of the run you want details for.
You can select multiple devices and from the Actions menu you can choose to: Run Policy or Reboot.

Columns (Device Table)

Use the Columns drop-down menu to adjust the Device Table.

You can rearrange the order of the data by dragging the column names to the desired position.

Device Table Details

You can view details about each run from the Details column of the Device Table.

Make sure you are showing the Details column.
Find the device and run time that you want details for.
Click the arrow to view information that supplements the summary. Use your cursor to scroll through the details.

Policy Run History

You can view history for a specific policy run. There are two ways to open the Policy Run History page from the main policy results report.

For a specific policy select Actions > View Policy History.
For a specific policy, go to the Policy Name column and click the name.

The Policy Run History page opens.

The event results are shown graphically.

This page provides a visual representation of the Device Table event data that you can drill into for specific dates. Use the drop-down menu to adjust the number of days presented.

CSV Export

Description of what you can find in the CSV export files. Use this list for reference.

CSV Export column	Description
custom_name	Name assigned to the device by the user.
device_count	This lists the number of devices included in the policy run.
device_deleted_at	Time and date when the device was removed.
device_id	Device ID (same as server ID)
device_uuid	Device UUID (universally unique identifier)
display_name	If configures, this shows the custom name, otherwise this is the hostname.
event_time	Time that the specific event was recorded.
exit_code	Remediation exit code returned by a worklet or advanced policy.
failed	This lists the number of devices with unsuccessful policy runs.
hostname	Unique label assigned to a device.
not_included	This is the number of devices not included in the policy run because they were disconnected or filtered out as a result of, for example, device targeting.
org_uuid	This is the ID for the current zone.
pending	This lists the number of devices for which the policy run has started but is not yet completed.
policy_deleted_at	This lists the specific date and time of when the policy was deleted.
policy_id	This is the legacy Policy ID.
policy_name	This is the name of the policy.
policy_type	This lists the policy type: Patch, Required Software, or Worklet
policy_uuid	This is the Policy ID (universally unique identifier).
remediation_not_applicable	This is the number of devices that were evaluated and no action was required. The devices were already up to date with the policy. Specifically, the devices were scanned and no remediation is necessary.
result_reason	This explains the result status.
result_status	This shows one of the known statuses: Successful, Pending, Failed, Remediation Not Applicable, or Not Included
run_time	This shows the date and time of when this run was started for this policy.
stderr	Standard error: available details listed in the report are included here.
stdout	Standard output: available details listed in the report are included here.
success	The number of devices for which the policy run was successful.

Caveats

Data does not pre-date March 1, 2024.
When a device is available after being offline, it checks for all missed patches and executes them in a single run. This run appears as a new policy run.
When a policy or device has been renamed, the report only shows the most current name, but retains all historical information.
- For example, if a previous run had policy A, and policy A was renamed to policy B, all future runs will show policy B (even the previous run that was run under the old name).
These results do not include runs initiated using the Run Now (FixNow) feature.