Configuration compliance status criteria

Configuration compliance status is determined by the following criteria:

Configuration Compliance—Single Server: If any differences are discovered between the application configuration and the actual configuration file on the target server, the server’s Configuration compliance status is Non-Compliant . The details pane of a Device explorer shows the Configuration category as Non-Compliant. If the server has several application configurations attached to it and any one of the actual configuration files targeted by the application configuration is different than the application configuration, the entire server is considered Non-Compliant in the Compliance view.

Configuration Compliance—Device Groups: An application configuration attached to a group of servers is considered Compliant if more than 5% of the servers in the group attached to the application configuration have a status of Non-Compliant . If this is the case, the aggregate compliance for Configuration displays as Non-Compliant. Another way to understand Non-Compliant for a device group is to remember that when less than 95% of the servers are Compliant, a status of Non-Compliant will display.

However, if more than 2%, but less than or equal to 5%, of all servers in a group have the status of Non-Compliant for that category, the status is Partial-Compliant . Another way to understand Partial-Compliant for a device group is to remember that when less than 98% but at least 95% of the servers are Compliant, a status of Partial-Compliant will display.

If less than 2% of all servers in a group have a Configuration status of Non-Compliant for that category, the overall status is Compliant. Another way to understand Compliant is to remember that at least 98% of the servers are Compliant.

The details pane for a group of servers in the Compliance view shows whether the application configurations are compliant or not. This information does not expand to show a breakdown of individual servers and policies.

You can modify the thresholds used to determine compliance for groups of servers.

Remediating configuration compliance—servers and groups

Remediation for an application configuration is slightly different than the other compliance category types. Rather than remediating a policy on a server (as you can with Audit, Audit Policy, Software, or Patch), to remediate an application configuration, you select an application configuration in the Device explorer or Group explorer. You then use the push function to push the values defined in the application to the actual configuration files on the server or group of servers. When you push an application configuration, all values defined in the application configuration templates are added to or replace those on the target configuration files.

The manner in which a value in an application configuration get pushed, such as sequences of lists and scalars, depends on how those values have been set in the application configuration inheritance hierarchy and what sequence merge modes have been configured in the configuration template.

To remediate application configurations on a server or on a group of servers:

To remediate an application configuration perform on of the following actions:

1. For a single server in the Device Explorer, in the navigation pane, select Devices > Servers > All Managed Servers, and then select a server.
2. For a group of servers, in the navigation pane, select Devices > DeviceGroups, and then select a group.
3. Right-click and then select Open to open the Device browser.
   In the Information pane, select Management Policies > Configured Application. See "Application configuration" in the SA 10.51 Developer section to continue.