FlexNet Inventory Agent Change Log (On-Premises)
Versions of the FlexNet inventory agent released for the on-premises edition of FlexNet Manager Suite, linked to features and fixes.
Release 2019 R2 (14.0.0)
Support for macOS 10.15
- Installation: The installation package supports both:
- 64-bit systems, to install FlexNet inventory agent on macOS 10.15 and later devices
- 32-bit systems, so that you can install this FlexNet inventory agent on devices running older 32-bit versions of macOS.
- Upgrade warning: If previous releases of FlexNet inventory agent are already installed on Apple inventory devices currently running earlier versions of macOS, these installations need to be upgraded to FlexNet inventory agent version 14.0.0 or later before the OS is upgraded to macOS 10.15. If the OS is upgraded without first upgrading the installed FlexNet inventory agents, the existing 32-bit FlexNet inventory agent will no longer be able to run on the upgraded inventory device. As a result, in this scenario it will be impossible for device policy to upgrade the FlexNet inventory agent. Recovering from such a case will require manually upgrading the FlexNet inventory agent to version 14.0.0 or later. However, if you upgrade FlexNet inventory agent first to 14.0.0 or later, and subsequently upgrade the macOS version to 10.15, the 64-bit support in this latest FlexNet inventory agent means that the system continues to operate as usual after the upgrades.
Inventory of Linux KVM virtualization
A locally-installed FlexNet inventory agent 14.0.0 collects inventory from
virtual machines (and hosts, although here you may prefer zero footprint inventory collection by an inventory beacon version 14.0.0 or later) on Linux virtual hosts
using Kernel-based Virtual Machine (KVM) infrastructure. To ensure that
inventory is imported from every guest VM on the host, the inventory from
the host must be gathered by an FlexNet inventory agent 14.0.0 (or later)
running as root, or the inventory beacon running zero footprint inventory collection as root. If, for some reason, you choose
to execute FlexNet inventory agent as some other, non-root
account, only those guest VMs to which that account has access are included in
inventory.
FlexNet inventory agent unique identifier
The FlexNet inventory agent now creates a unique identifier on a device when it
executes for the first time. This unique identifier, called the AgentID, is used
when resolving the inventory data from a device to determine which computer
record matches the inventory (earlier versions relied on the domain name and
computer name, which are still the fallback used if the AgentID is missing).
With the AgentID, multiple devices with same domain name and computer name can
now be distinguished from one another, so that separate computer records are
created in the inventory database. This feature works for any deployment of the
ndtrack executable, including the locally installed
FlexNet inventory agent, zero footprint inventory collection managed by an inventory beacon, or the lightweight FlexNet Inventory Scanner.
Java inventory also on UNIX-like platforms
Collection of additional inventory for Java, already supported on Microsoft Windows, is now added for all supported UNIX-like platforms. In the file /var/opt/managesoft/etc/config.ini, the includedirectory preference must be correctly set to allow scanning of the folder where Java is installed – this is set automatically when the installer for FlexNet inventory agent is run; but if you are using third-party deployment, you may need to manage this separately. And as always, with the FlexNet Inventory Scanner, you must include the appropriate setting in the command line, overriding its default value of not doing any file scanning.
Release 2019 R1 (13.2.0)
Enhanced inventory from Microsoft Azure VMs
Although inventory could be collected from VMs on Microsoft Azure since the earlier 2018 R1 (13.0.0) release, those intermediate releases relied on the parallel use of the Microsoft Azure adapter to complete the inventory picture (especially the host/guest relationships). From this release, the FlexNet inventory agent locally installed on the guest instance reports the full set of Microsoft Azure VM data, so that running the separate adapter is no longer mandatory (however, the Microsoft Azure adapter remains useful for identifying inventory gaps, where the FlexNet inventory agent has not been installed on a guest).
Auto-upgrades of FlexNet inventory agent work in custom installation paths (AIX/Linux)
With previous versions of FlexNet inventory agent on either AIX or Linux operating systems, upgrades (or downgrades) driven by downloaded device policy were available only when the installation was in the default location. From this release, policy-driven upgrades or downgrades are extended to cover installations in custom locations on either AIX or Linux operating systems.
Release 2018 R2 (13.1.1)
Signing of Linux RPM packages
Signing of Linux RPM (Red Hat Package Manager) packages gives you an additional layer of security if you are managing your own installation of Linux RPM packages for FlexNet inventory agent. (Only RPM packages are now signed, with DEB packages unchanged.) The public key is available from the Product and License Center as a separate download titled Inventory agent 13-1-0+ Linux RPM installer public key.zip. Your company password for the Flexera Customer Community is required to access this download. The fact that the key must be downloaded from a separate, password-protected source gives you some improvement in security.
Release 2018 R1 (13.0.1)
Local inventory from Oracle pluggable databases
- The full FlexNet inventory agent, whether deployed by ‘adoption’ or by third-party tools
- The lightweight FlexNet Inventory Scanner
- Zero-footprint inventory gathering, where an inventory beacon temporarily installs the inventory component on the target server, runs it, and removes it again (leaving zero installation footprint).
Release 2017 R3 (12.4.0)
Gathering inventory from standby Oracle database instances
The FlexNet inventory agent, locally installed on an Oracle Database server, collects software inventory from any operational Oracle database instances (as well as collecting hardware inventory, as required for certain license types). From this release, it also gathers inventory from Oracle instances that are in standby (that is, instances that are in MOUNT mode but not READ mode). This includes Oracle Data Guard instances that are in standby, awaiting a possible switch into production.
However, Oracle advises that certain inventory queries are impossible on a standby Oracle database instance. Therefore, the inventory data from an Oracle instance that is only ever inventoried while in standby is less complete than the inventory collected from active Oracle database instances. If the same (standby) database instance is subsequently inventoried while in MOUNT mode, the missing inventory values are added to the instance record in FlexNet Manager Suite. Conversely, if an Oracle database instance has been inventoried while active, and is subsequently inventoried while in standby, the additional values are removed for consistency with the latest inventory.
This functionality is also available in the lightweight FlexNet Inventory Scanner, and in zero footprint inventory collection, where an appropriate inventory beacon downloads and runs the inventory core components on a target device.
Release 2017 R2 (12.3.0)
Support for IPv6 address families
- Both IPv6 and dual stack (IPv6 and IPv4) networks are supported, in addition to existing IPv4 support.
- Includes both the full FlexNet inventory agent and the lightweight FlexNet Inventory Scanner.
- Note that link-local IPv6 addresses, which are valid and unique only on a single network link, are not supported, since these are contrary to the policy-driven nature of managed devices. However, both global and unique local scopes are supported.
- The FlexNet inventory agent uses the first IP address returned after a DNS request, by default – regardless of its address family. There is also a preference you can set to favour either IPv6 or IPv4, for those situations where manual configuration is desirable.
- Files downloaded to all FlexNet inventory agents cannot use the IPv6 address family, since such details may reach legacy versions of FlexNet inventory agent that cannot process the new address format. Examples include the fail-over list of all inventory beacons, or the networkname property in the C:\Program Files (x86)\Flexera Software\Inventory Beacon\DotNet\conf\BeaconEngine.config file that configures the web server on the inventory beacon. Instead, use either the hostname or fully-qualified domain name of the inventory beacon, so that inventory devices rely (as normal) on DNS results to contact an inventory beacon appropriate for them.
- CAL device license consumption is only supported using the IPv4 address family
Release 2017 R1 (12.2.0)
Remediation of security vulnerability
The Common Vulnerabilities and Exposures (CVE) identifier of this vulnerability is CVE-2017-6885. To understand the potential consequences of this vulnerability, please refer to the Common Consequences section of Common Weakness Enumeration CWE-426. The Common Vulnerability Scoring System (CVSS) base score for this vulnerability is 7.8 and the temporal score is 7.0.
This fix applies to both the full FlexNet inventory agent and the lightweight FlexNet Inventory Scanner, and also requires updates of FlexNet Beacon.
Release 2016 R1 SP1 (12.1.0)
Improved HTTPS support on UNIX-like platforms
Communication between the FlexNet inventory agent and inventory beacons may be secured with the HTTPS protocol. For typical (maximum) security, this requires the exchange of server certificates, and checking by the FlexNet inventory agent that the server certificate has not been revoked by the Certificate Authority (CA).
On Windows platforms, certificate checking is determined by Group Policy. In previous releases for FlexNet inventory agent running on UNIX-like platforms, revocation checking was supported using Certificate Revocation Lists (CRLs). This can be time-consuming, since each check can require downloading the entire listing of revoked certificates.
A newer technology is to use OCSP revocation checking. The Online Certificate Status Protocol allows a much faster request to the OCSP server for the revocation status of a single certificate.
This release allows administrators to prioritize OCSP and CRL checking for UNIX-like platforms. It also allows failover from one system to the other with a simple preference setting for the FlexNet inventory agent.