Files Copied to a Remote Machine

Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

During discovery, Data Flow Probe copies files to a remote Windows machine to enable discovery of the machine's components. The files are copied to the %SystemRoot%\system32\drivers\etc\ folder on the remote machine.

Note

Data Flow Management runs HPCmdSvc.exe to connect to and retrieve the Shell on the remote machine.
When the wmic command is launched on the remote Windows machine, by the Host Connection by Shell or Host Resources by Shell or Host Applications by Shell jobs, an empty TempWmicBatchFile.bat file is created.

The following files are copied:

File	Content Pack Version	Description
adsutil.vbs	All	The Visual Basic script used for discovery of Microsoft IIS applications. DFM copies this script to the remote machine to discover IIS. Relevant DFM Job: IIS Applications by NTCMD or UDA
diskinfo.exe	All	The executable that enables the retrieval of disk information when it is not available to be retrieved by wmic. DFM discovers default disk information with the wmic query. However, if the wmic query fails to execute, DFM copies the diskinfo.exe file to the remote machine. This failure can occur if, for example wmic.exe is not included in the PATH system variable or is completely absent on the remote machine, as is the case on Windows 2000. Relevant DFM Job: Host Resources by Shell
Exchange_Server _2007_Discovery.ps1	CP4	The PowerShell script for MS Exchange 2007 discovery. DFM uses a PowerShell scenario to discover Microsoft Exchange 2007 by NTCMD. This file, therefore, must be copied to the remote machine. Relevant DFM Jobs: Microsoft Exchange Connection by NTCMD or UDA Microsoft Exchange Topology by NTCMD or UDA
GetFileModification Date.vbs	CP5	The Visual Basic script for retrieving the file modification date (disregarding locale). The most common use case is when DFM must retrieve the last modification date of a configuration file of a discovered application. Relevant DFM Jobs: Apache Tomcat by Shell File Monitor by Shell IIS Applications by NTCMD or UDA JEE Weblogic by Shell JEE WebSphere by Shell or JMX JEE WebSphere by Shell SAP System by Shell Service Guard Cluster Topology by TTY Siebel Application Server Configuration Software Element CF by Shell Veritas Cluster by Shell Web Server by Shell
getfilever.vbs	All	The Visual Basic script used to identify the version of the running software. The script retrieves the executable or DLL file version on Windows machines. This script is used by Shell-based application signatures plug-ins to retrieve the version of a particular software on the remote machine. Relevant DFM Job: Host Applications by Shell
junction.exe	CP5	This executable file, part of the Sysinternals Suite (http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx), enables the creation of a junction point. DFM uses this file if the linkd.exe and mklink.exe tools are absent on the remote machine. When DFM runs discovery on a Windows x64 machine, DFM needs to bypass the Windows redirect feature running on that machine. DFM does this by creating a link to the %SystemRoot%\System32 folder with either the linkd.exe or mklink.exe tool. However, if these tools are missing on the remote machine, DFM transfers junction.exe to the remote machine. DFM is then able to launch the 64-bit version of the system executable files. (Without this 64-bit version, DFM would be locked into an isolated 32-bit world.) This junction point is automatically removed once discovery is complete. Relevant DFM Jobs: Host Resources by Shell Host Applications by Shell Microsoft Exchange Connection by NTCMD or UDA Microsoft Exchange Topology by NTCMD or UDA
meminfo.exe	All	The executable that enables the retrieval of memory information. DFM discovers memory information with the wmic query. However, if the wmic query fails to execute, DFM copies the meminfo.exe file to the remote machine. This failure can occur if, for example, wmic.exe is not included in the PATH system variable or is completely absent on the remote machine, as is the case on Windows 2000. Relevant DFM Job: Host Applications by Shell
reg_mam.exe	All	The copy of the Microsoft reg.exe file that enables querying the registry. If DFM does not discover a native reg.exe file, this executable is copied to the remote Windows machine. This situation occurs with some previous Windows versions (for example, Windows 2000) where the tool is not included by default but can still function there correctly. Relevant DFM Job: Host Applications by Shell

File

Content Pack Version

Description

adsutil.vbs

All

The Visual Basic script used for discovery of Microsoft IIS applications. DFM copies this script to the remote machine to discover IIS.

Relevant DFM Job: IIS Applications by NTCMD or UDA

diskinfo.exe

All

The executable that enables the retrieval of disk information when it is not available to be retrieved by wmic.

DFM discovers default disk information with the wmic query. However, if the wmic query fails to execute, DFM copies the diskinfo.exe file to the remote machine. This failure can occur if, for example wmic.exe is not included in the PATH system variable or is completely absent on the remote machine, as is the case on Windows 2000.

Relevant DFM Job: Host Resources by Shell

Exchange_Server
_2007_Discovery.ps1

CP4

The PowerShell script for MS Exchange 2007 discovery.

DFM uses a PowerShell scenario to discover Microsoft Exchange 2007 by NTCMD. This file, therefore, must be copied to the remote machine.

Relevant DFM Jobs:

Microsoft Exchange Connection by NTCMD or UDA
Microsoft Exchange Topology by NTCMD or UDA

GetFileModification
Date.vbs

CP5

The Visual Basic script for retrieving the file modification date (disregarding locale).

The most common use case is when DFM must retrieve the last modification date of a configuration file of a discovered application.

Relevant DFM Jobs:

Apache Tomcat by Shell
File Monitor by Shell
IIS Applications by NTCMD or UDA
JEE Weblogic by Shell
JEE WebSphere by Shell or JMX
JEE WebSphere by Shell
SAP System by Shell
Service Guard Cluster Topology by TTY
Siebel Application Server Configuration
Software Element CF by Shell
Veritas Cluster by Shell
Web Server by Shell

getfilever.vbs

All

The Visual Basic script used to identify the version of the running software. The script retrieves the executable or DLL file version on Windows machines.

This script is used by Shell-based application signatures plug-ins to retrieve the version of a particular software on the remote machine.

Relevant DFM Job: Host Applications by Shell

junction.exe

CP5

This executable file, part of the Sysinternals Suite (http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx), enables the creation of a junction point. DFM uses this file if the linkd.exe and mklink.exe tools are absent on the remote machine.

When DFM runs discovery on a Windows x64 machine, DFM needs to bypass the Windows redirect feature running on that machine. DFM does this by creating a link to the %SystemRoot%\System32 folder with either the linkd.exe or mklink.exe tool. However, if these tools are missing on the remote machine, DFM transfers junction.exe to the remote machine. DFM is then able to launch the 64-bit version of the system executable files. (Without this 64-bit version, DFM would be locked into an isolated 32-bit world.)

This junction point is automatically removed once discovery is complete.

Relevant DFM Jobs:

Host Resources by Shell
Host Applications by Shell
Microsoft Exchange Connection by NTCMD or UDA
Microsoft Exchange Topology by NTCMD or UDA

meminfo.exe

All

The executable that enables the retrieval of memory information.

DFM discovers memory information with the wmic query. However, if the wmic query fails to execute, DFM copies the meminfo.exe file to the remote machine. This failure can occur if, for example, wmic.exe is not included in the PATH system variable or is completely absent on the remote machine, as is the case on Windows 2000.

Relevant DFM Job: Host Applications by Shell

reg_mam.exe

All

The copy of the Microsoft reg.exe file that enables querying the registry.

If DFM does not discover a native reg.exe file, this executable is copied to the remote Windows machine. This situation occurs with some previous Windows versions (for example, Windows 2000) where the tool is not included by default but can still function there correctly.

Relevant DFM Job: Host Applications by Shell