When running Delta Update with a simple custom filter that is built with Query Builder in the Symantec Management Console and is used in the target of a policy, a Full Update is run for it instead of Delta Update as indicated by a warning message in logs. The cause is also clearly indicated in the warning that appears in the logs:

At least one scoping field must be selected.

This has no functionality impact but may negatively affect larger environments with many resources and a number of affected filters.

Note that Full Update is run only on the specific filter, not all filters.

Priority: 2
Process: AeXSvc (1596)
Thread ID: 132
Module: AeXSVC.exe
Source: Altiris.NS.StandardItems.Collection.NSDataSrcBasedResourceCollection.DeltaUpdateMembership
Description: Unexpected exception has occurred during the construction of the SQL for delta collection update for 'New Filter (9da1f04f-5d4f-4e00-adad-7ef09b0dec24)'. Full update is run instead.
( Exception Details: Altiris.DataSource.Exceptions.DataSourceSchemaException: Failed to perform a delta collection membership update for the resource collection 'New Filter (aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa)'. At least one scoping field must be selected.

Affected filter does not have a Scoping set True for any fields.

When a filter is created in Symantec Management Console using Query Builder, a Scoping field is not set automatically and needs to be set manually.

The default behavior of Query Builder is currently being reviewed by Symantec.

There needs to be at least one field in the filter that has Scoping set to True. Scoping should generally be set True for a field that contains Resource GUID.

To fix this issue for a specific filter, you should add a scoping field, for example in a filter that has base resource set to Computer:

1. Edit the filter
2. Fields > [Computer].[Guid] > Edit
3. Check 'Scoping' > OK