I have the following query (riffing off of the canned k1000 report for identifying services set to auto start that are not running):

SELECT M.NAME AS 'System',

NS.DISPLAY_NAME AS 'Service Display Name',

NS.NAME AS 'Service Name',

NS.STARTUP_TYPE AS 'Startup Type',

NS.STATUS AS 'Service Status'

FROM MACHINE M

LEFT JOIN MACHINE_NTSERVICE_JT MNJT ON M.ID = MNJT.MACHINE_ID

LEFT JOIN NTSERVICE NS ON MNJT.NTSERVICE_ID = NS.ID

WHERE M.OS_NAME LIKE '%Windows%'

AND NS.STARTUP_TYPE LIKE 'SERVICE_AUTO_START'

AND NS.STATUS LIKE 'SERVICE_STOPPED'

-- AND NS.NAME = 'AVP'

AND NS.NAME = 'ntrtscan'

-- AND NS.NAME RLIKE 'AVP'|'ntrtscan'

GROUP BY M.NAME, NS.NAME

The goal is to identify all Windows machines with either one or the other service, 'ntrtscan' or 'avp', stopped.

If I use 

AND NS.NAME = 'AVP'

I get one result.

If I use 

AND NS.NAME = 'ntrtscan'

I get three results.

If I use 

AND NS.NAME RLIKE 'AVP'|'ntrtscan'

I get throusands of results when I'm expecting four.

If I use 

AND NS.NAME RLIKE 'AVP'

I get one result... What am I missing?

Thanks

Answer Summary:
Cancel
0 Comments   [ + ] Show Comments

Comments

Please log in to comment

Answers

0

Take the ' ' off of the RLIKE. It should just be at the beginning and the end. 

AND NS.NAME RLIKE 'AVP|ntrtscan'

Answered 04/02/2013 by: dugullett
Red Belt

  • Arggg. That was dumb. Thanks dugullett!
Please log in to comment
Answer this question or Comment on this question for clarity
Admin Script Editor
Admin Script Editor is an integrated scripting environment available free here at ITNinja

Share