All of us who work in IT have been scrambling to assess our exposure to the recently disclosed CVE-2021-44228 vulnerability in Apache Log4j 2 (widely referred to as Log4Shell). One key question everyone is asking is: How can we detect and identify systems that are potentially vulnerable?
There are many tactics being used to answer this question. This article shares one approach for organizations using FlexNet Manager Suite On-Premises with inventory gathered by the FlexNet Inventory Agent. It involves:
-
Configuring agents to gather details of files with specific names
-
Extracting and reporting on those details
Configuring agents to gather details of files with a specified name
The FlexNet inventory agent’s IncludeFile preference can be configured to specify names of files whose details should be included when gathering inventory. For example, setting this preference to: log4j-core-*.jar will include details of files found on the filesystem that match the pattern.
Ways to configure the IncludeFile preference
-
Windows registry setting
Set the value in the registry at:
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\ManageSoft Corp\ManageSoft\Tracker\CurrentVersion\IncludeFile
-
UNIX-like systems configuration file
Add the setting to /var/opt/managesoft/etc/mgsconfig.ini. For example:
cat >/tmp/tempconfig.ini <<EOF
[ManageSoft\Tracker\CurrentVersion]
IncludeFile=log4j-core-*.jar
EOF
/opt/managesoft/bin/mgsconfig -i /tmp/tempconfig.ini
rm /tmp/tempconfig.ini
-
Agent policy settings via SQL script
There’s no UI for this, but you can use a SQL script to update the compliance database:
DECLARE @TargetName NVARCHAR(100)
SET @TargetName = 'Target__windows' -- or 'Target__osx' or 'Target__unix'
EXEC dbo.BeaconTargetPutByNameInternal
@Name = @TargetName,
@Internal = 1,
@Description = NULL,
@Visible = 0
DECLARE @btid INT
SELECT @btid = BeaconTargetID FROM dbo.BeaconTarget WHERE Name = @TargetName
EXEC dbo.BeaconTargetPropertyValuePutByKeyNameBeaconTargetID
@KeyName = 'CTrackerIncludeFile',
@BeaconTargetID = @btid,
@Value = 'log4j-core-*.jar'
EXEC dbo.BeaconPolicyUpdateRevision
-
Command-line override
If invoking ndtrack directly, use:
ndtrack -t Machine -o IncludeFile=log4j-core-*.jar
NOTE: Agent settings to scan for file details must be enabled for the IncludeFile preference to be effective. These are typically configured via Discovery & Inventory > Settings in the FlexNet Manager Suite web UI.
Once configured, file details will appear in NDI inventory files like this:
<Content MD5="NO_MD5" Size="5427604">
<Instance Path="C:\Path\log4j-core-2.16.0.jar" DateTime="20211212T233542"/>
</Content>
Reporting on gathered details
Once inventory has been uploaded and imported, you can run SQL queries against the inventory database to extract file details.
Example query
SELECT
ComputerName = c.ComputerCN,
FileName = sfn.Name,
sp.Path,
sf.Size,
Timestamp = sf.DateTime,
InventoryDate = ir.SWDate
FROM dbo.SoftwareFileName sfn
JOIN dbo.SoftwareFile sf ON sf.SoftwareFileNameID = sfn.SoftwareFileNameID
JOIN dbo.SoftwareFilePath sp ON sp.SoftwareFilePathID = sf.SoftwareFilePathID
JOIN dbo.Computer c ON c.ComputerID = sf.ComputerID
JOIN dbo.InventoryReport ir ON ir.ComputerID = sf.ComputerID
WHERE sfn.Name LIKE 'log4j-core-%.jar'
Limitations of relying on file details for security assessments
While identifying systems with specific files can be helpful, it’s not foolproof:
-
Presence ≠ vulnerability: Just because a file exists doesn’t mean it’s exploitable.
-
Absence ≠ safety: A missing file doesn’t guarantee the system is secure.
This tactic should be one of many used in a layered security assessment.
Possible extensions
Import additional file types as evidence
By default, FlexNet Manager Suite only imports files with extensions like .exe, .sys, .sig, etc. Advanced users may modify import procedures to include other extensions (like .jar).
Use the reporting interface
Instead of direct SQL queries, consider using built-in reporting tools to surface this data through the UI.
Related Articles
FlexNet Manager Suite log files and locations 182Number of Views How to enable FlexNet Manager Suite diagnostic tracing 270Number of Views Install the SAP connector libraries for SAP integration with FlexNet Manager Suite versions 2023 R1 or above 37Number of Views How to configure replication to collect a uploaded agent files on the FlexNet Manager Suite inventory server 42Number of Views VMware stand-alone inventory agent esxquery.exe for FlexNet Manager Suite & Flexera One ITAM 113Number of Views
Hi, I am Reva - Ask me anything.
No new updates
Thanks for the feedback!
Your feedback has been saved.Rate this response:
Add Additional feedback ( Optional )
Are you sure you want to cancel
the case creation?
Are you sure you want to cancel the case creation?
Are you sure you want to close this case
| Products | Region | Phone Numbers |
|---|---|---|
| FlexNet Operations FlexNet Embedded FlexNet Publisher FlexNet Connect FlexNet Code Insight InstallAnywhere InstallShield |
North America * |
+1 630-332-2513 (toll) +1 877-279-2853 (toll-free in North America) |
| Europe * |
+44 1925 944367 (toll) +44 800 047 8642 (toll-free in Europe) |
|
| Japan * | +81 3-4540-5335 (select option 2) | |
| Australia * |
+61 3 9895 2177 +61 1800 560 603 (toll-free in Australia) |
|
|
Usage Intelligence (formerly
Revulytics) Compliance Intelligence |
Please use the Case Portal to submit your support ticket or reach out to your Revenera contact. | |
Case id: 00001065
Activity: Status change: 2 hours ago