With our next release of Open-AudIT (likely 4.3.4) we are further refining how we match devices discovered to devices in the database.
This is an optional configuration option, enabled by setting discovery_use_org_id_match in the global configuration.
When you create a discovery you have an option to devices_assigned_to_org. This means that any devices discovered for this discovery will be assigned (have system.org_id set to) your chosen Organisation.
...
- match_dbus
- match_fqdn
- match_dns_fqdn
- match_hostname
- match_dns_hostname
- match_ip
- match_ip_no_data
- match_serial
- match_serial_type
- match_sysname
...
- DBus - if you clone a Linux virtual machine, unless you manually regenerate this (and in my experience, people do not) it will remain the same.
- FQDN - This should be globally unique, but I have seen instances where it is not.
- Hostname - Think of mail.domain1.com and mail.domain2.com - same hostname.
- IP - It is not uncommon to have an overlapping address space in a given Organisation. Not ideal, but not uncommon.
- Serial - It is very common for second tier motherboard manufacturers to not set this, to set it to all 0's or even all F's.
- Sysname - This is settable by users and so even though it should be globally unique, there is certainly no guarantee of this.
...
If this change does not work for you, all is not lost. We have added a configuration item (set to y n by default, so it will use not this new option out of the box) called discovery_use_org_id_match. If you change it to n y then the OrgID assigned to the device by the discovery will not be used in the relevant match rules. We would discourage the disabling of this rule and recommend fixing your devices or altering your discoveries instead. Fix your data, not the code 