TrueSight Server Automation (TSSA) Windows Patch Analysis job does not report a expected patch as missing, which is not installed on the target server. How to troubleshoot this?
 

The Windows Patch Analysis Job reports a patch as missing if the following conditions are all met:

1. The patch exists in the catalog and is not obsolete
2. The patch is considered per the Analysis Job options
3. The analysis engine scans for the patch and finds it to be missing per the detection logic

NOTES:
- If the correct patch object is found in the catalog and of Bulletin type, open it and check the 'IS_OBSOLETE' property
- If it is obsolete, then by default the obsolete patches are not reported in the analysis results.
- Also make sure that the patch is not superseded by later patches (check out 'Superseded By' property value to find the newer patch/bulletin ID)
- Validate that the Patch Analysis Job has the correct patch type selected. (open the expected patch to confirm the type and make sure the confirmed type is selected in the 'Analysis Options' tab of the patch analysis job)
- Ivanti/shavlik metadata XML files are updated weekly and they sometimes contain a 'Revision' section with recent fixes. Prior to troubleshooting, make sure to update the Patch Catalog and retest.

If above two conditions are met and require assistance with investigating patch analysis detection logic, please open a case with BMC customer support sharing the following data:
- screenshot showing the expected patch in the patch catalog
- screenshot showing 'Analysis Options' tab of the patch analysis job
- export of the patch analysis job run log
- 'AnalysisTrace.log' (located under '<RSCD agent install dir>\RSCD\Transactions\analysis_archive\__JobRun-xxxxxx' folder)
- 'shavlik_result.xml' (located under '<RSCD agent install dir>\RSCD\Transactions\analysis_archive\__JobRun-xxxxxx' folder)

See also the following section of the TSSA documentation for use cases and the guidelines, where TrueSight Server Automation Windows Patch Analysis results are inconsistent with results obtained from other products, such as Windows Live Update, Windows Server Update Services (WSUS), or PatchLink.