As far as I could tell from the sources and DB the system_key field is used to ensure uniqueness for the devices. However I've encountered 2 - 3 situations in which I'd say the behavior is incorrect.
Most, if not all of our hardware, reports the serial number correctly when audited. I consider this a better choice for determining the existence of the system in the DB. Is there a way to change the priorities for how the system_key field is constructed and opt for the <equipment-type_serial> as the first choice?
Interesting you should ask... What you describe is actually working by design. The next release will do away with the system_key altogether. We will check for a match with:
Thank you for your very quick reply!
We can live with the first 2 cases. We can make sure the system is in production and whenever we change the hostname we can delete the old entry as it doesn't happen all that often.
However the third one, where a computer audited later on overwrites a different computer surely is not by design. I've searched the "discovery_mac_match" option in Admin > Config and I could not find it.
We're using Open Audit Community 1.12, internal version 20160130.
Let me know if I can provide any data if that could solve this.
1.12.2 contains discovery_mac_match.
One device will only overwrite another if the attributes match. Maybe check the UUID is actually set (I've seen them all 0's or all F's).
Powered by a free Atlassian Confluence Open Source Project License granted to Opmantek. Evaluate Confluence today.