I have the following query (riffing off of the canned k1000 report for identifying services set to auto start that are not running):

SELECT M.NAME AS 'System',

NS.DISPLAY_NAME AS 'Service Display Name',

NS.NAME AS 'Service Name',

NS.STARTUP_TYPE AS 'Startup Type',

NS.STATUS AS 'Service Status'

FROM MACHINE M

LEFT JOIN MACHINE_NTSERVICE_JT MNJT ON M.ID = MNJT.MACHINE_ID

LEFT JOIN NTSERVICE NS ON MNJT.NTSERVICE_ID = NS.ID

WHERE M.OS_NAME LIKE '%Windows%'

AND NS.STARTUP_TYPE LIKE 'SERVICE_AUTO_START'

AND NS.STATUS LIKE 'SERVICE_STOPPED'

-- AND NS.NAME = 'AVP'

AND NS.NAME = 'ntrtscan'

-- AND NS.NAME RLIKE 'AVP'|'ntrtscan'

GROUP BY M.NAME, NS.NAME

The goal is to identify all Windows machines with either one or the other service, 'ntrtscan' or 'avp', stopped.

If I use 

AND NS.NAME = 'AVP'

I get one result.

If I use 

AND NS.NAME = 'ntrtscan'

I get three results.

If I use 

AND NS.NAME RLIKE 'AVP'|'ntrtscan'

I get throusands of results when I'm expecting four.

If I use 

AND NS.NAME RLIKE 'AVP'

I get one result... What am I missing?

Thanks

Answer Summary:
Cancel
0 Comments   [ + ] Show Comments

Comments

Please log in to comment

Answers

0

Take the ' ' off of the RLIKE. It should just be at the beginning and the end. 

AND NS.NAME RLIKE 'AVP|ntrtscan'

Answered 04/02/2013 by: dugullett
Red Belt

  • Arggg. That was dumb. Thanks dugullett!
Please log in to comment
Answer this question or Comment on this question for clarity