When host obtains new IP, all records with previous host name changed to new host name.

 
1
0
-1

A computer that had been previously audited many times, obtained a new IP address and all the records listing that computer with a certain host name was changed to the host name of the computer that now has the previous IP address? 

Computer A with IP 1.1.1.1 audited.  Computer A now has IP 1.1.1.8.  Computer Q (never been audited) now has IP 1.1.1.1.  Computer A's records have all been changed to reflect the new name of Computer Q.  The new "Computer A" information that had been previously retreived when audited remains the same except the host name.

Not able to repeat.

Community Edition v. 1.8.1

craig

    CommentAdd your comment...

    4 answers

    1.  
      1
      0
      -1

      I went ahead and upgraded and do see the choice and the setting is currently set to no on ip and yes on host.  If it happens again i will update this case.

      Thanks.

      craig

        CommentAdd your comment...
      1.  
        1
        0
        -1

        Hi Mark.  I apologize for my delinquent response as higher priority tasks were calling.  I am only now able to get back to evaluating the software.  I will review your 9.13.15 response and get back to you.

        Best Regards,

        craig

          CommentAdd your comment...
        1.  
          1
          0
          -1

          It might be worth your while to check out the below wiki page and see if any of the retrieved attributes are the same and causing Open-AudIT to false positive match the different systems.

          As well as that, the code in open-audit/code_igniter/application/models/system.php in the function find_system will detail the possible combinations of attributes that would cause a match.

          Information about how Open-AudIT processes and stores data

          I have seen things in the past like using the same lightning to ethernet adapter of different Mac's which results in the same MAC Address and causes a false positive match. Not that this is occurring in this case, but take a look at the attributes used to match a device and see if any of them might actually be the same.

          I'll see if I can replicate it here. FYI - We have a new config option in 1.8.2 that enables (or disables) matching a device based on its ip address.

            CommentAdd your comment...
          1.  
            1
            0
            -1

            Hello Craig,

            This sounds like it might be a bug, but difficult to tell if you can't replicate. I will enter a ticket with our Support team, who will reach out to you for more information if needed.

            Regards,

            Mark H

              CommentAdd your comment...