Child pages
  • Matching Devices
Skip to end of metadata
Go to start of metadata

Matching Devices

When Open-AudIT receives data about a device it must determine if this data matches a device that already exists within its database, or it's a new device that it doesn't know about.

We use a series of property matches to determine this. These properties are available to set in the configuration of Open-AudIT. The properties and their default values are listed below.

The default values of 'y' and 'n' simply mean YES and NO. I will use YES and NO in the description, rather than 'y' and 'n'. The stored value should always be either a lowercase y or n.

 

PropertyDefault ValueDescription
match_dbusnLinux based devices only. The DBUS id is supposed to be unique on each Linux device. It is set to NO by default because ESX, upon cloning a guest virtual machine, does not tell the operating system to recreate this identifier. We were receiving reports of discovered devices overwriting one another and this was the culprit.
match_hostnameyShould we match a device based on its hostname? Set to YES as hostnames should be unique to a network. This may be a candidate for changing as some users may wish to audit disparate networks (say several different customers networks) that contain hostnames that are identical to others already in Open-AudIT. Say 'web' or 'mail' or 'dns', etc. Certain hostnames are not uncommon to use.
match_hostname_dbusyLinux based devices only. Should we use the combination of the hostname (as determined by Open-AudIT) and DBUS id (as reported by an audit script or SSH command) to determine a device match? Set to YES as this is considered a reliable combination.
match_hostname_macyShould we use the combination of the hostname (as determined by Open-AudIT) and MAC address(es) (as reported by an audit script, SSH command, WMI command or SNMP query) to determine a device match? Set to YES as this is considered a reliable combination.
match_hostname_serialyShould we use the combination of the hostname (as determined by Open-AudIT) and serial (as reported by an audit script, SSH command or SNMP query) to determine uniqueness. Set to YES as this is considered a reliable combination.
match_hostname_uuidyShould we use the combination of the type (as determined by Open-AudIT) and serial (as reported by an audit script, SSH command or WMI command) to determine uniqueness. Set to YES as this is considered a reliable combination.
match_ipnShould we match based only on the device's IP address? Set to NO because DHCP will cause false positive matches. This may be acceptable to set to YES if you can guarantee no devices will change IP addresses. You may only ever audit a server network for example. In most cases, it is best to leave this to NO.
match_macyShould we match a device based only on it's discovered MAC addresses. Set to NO prior to 1.14.4. Post 1.14.4 will be set to YES. A MAC address should be unique on a network. See below for an exception to the rule.
match_mac_vmwaren

VMware Workstation tends to use MAC addresses that are not globally unique. IE - Two different workstations may be running VMware Workstation and have two different virtual machines that have the same MAC address. These machines won't ever need to perform networking outside their hosts using this MAC address, but Open-AudIT will discover the MAC addresses upon an audit. Should we determine uniqueness based on these mac addresses? These MAC addresses typically start with one of the following: 00:0c:29, 00:50:56, 00:05:69, 00:1c:14.

match_serialyShould we use the serial (as reported by an audit script, SSH command, WMI command or SNMP query) to determine a device match? Set to YES as this is considered a reliable attribute.
match_serial_typeyShould we use the combination of the type (as determined by Open-AudIT) and serial (as reported by an audit script, SSH command, WMI command or SNMP query) to determine uniqueness. Set to YES as this is considered a reliable combination.
match_uuidyShould we use the UUID (as reported by an audit script, SSH command or WMI command) to determine a device match? Set to YES as this is considered a reliable attribute.
  • No labels