A computer that had been previously audited many times, obtained a new IP address and all the records listing that computer with a certain host name was changed to the host name of the computer that now has the previous IP address?
Computer A with IP 22.214.171.124 audited. Computer A now has IP 126.96.36.199. Computer Q (never been audited) now has IP 188.8.131.52. Computer A's records have all been changed to reflect the new name of Computer Q. The new "Computer A" information that had been previously retreived when audited remains the same except the host name.
Not able to repeat.
Community Edition v. 1.8.1
I went ahead and upgraded and do see the choice and the setting is currently set to no on ip and yes on host. If it happens again i will update this case.
Hi Mark. I apologize for my delinquent response as higher priority tasks were calling. I am only now able to get back to evaluating the software. I will review your 9.13.15 response and get back to you.
It might be worth your while to check out the below wiki page and see if any of the retrieved attributes are the same and causing Open-AudIT to false positive match the different systems.
As well as that, the code in open-audit/code_igniter/application/models/system.php in the function find_system will detail the possible combinations of attributes that would cause a match.
I have seen things in the past like using the same lightning to ethernet adapter of different Mac's which results in the same MAC Address and causes a false positive match. Not that this is occurring in this case, but take a look at the attributes used to match a device and see if any of them might actually be the same.
I'll see if I can replicate it here. FYI - We have a new config option in 1.8.2 that enables (or disables) matching a device based on its ip address.
This sounds like it might be a bug, but difficult to tell if you can't replicate. I will enter a ticket with our Support team, who will reach out to you for more information if needed.