What value are you using for uuid_type in the audit.config? Is it possible that you have multiple machines with the same UUID?
When OpenAudit adds new software it grabs the latest audit timestamp for a machine specified by its UUID. [code]"SELECT MAX(system_audits_timestamp) AS timestamp FROM system_audits WHERE system_audits_uuid = '$uuid'"[/code]
Then it tires to update any existing software given the machines uuid, the software name and the timestamp. [code]"UPDATE software SET software_timestamp = '$timestamp', software_count = '$count', software_version = '$software_version', software_location = '$software_location', software_uninstall = '$software_uninstall', software_install_date = '$software_install_date', software_publisher = '$software_publisher', software_install_source = '$software_install_source', software_system_component = '$software_system_component', software_url = '$software_url', software_comment = '$software_comments' WHERE software_uuid = '$uuid' AND software_name = '$software_name' AND (software_timestamp = '$software_timestamp' OR software_timestamp = '$timestamp')"[/code] If the update doesn't work because no existing software with the same uuid, name and timestamp is found then the software is added as new.
To troubleshoot you'd need to take an example software audit line and trace it through the OpenAudit add process to see why it's not doing what you'd expect.
|