Open-AudIT

What's on your network?
It is currently Thu Jan 18, 2018 8:32 am

All times are UTC + 10 hours




Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 5 posts ] 
Author Message
PostPosted: Tue Feb 20, 2007 11:41 am 
Offline
Newbie

Joined: Fri Aug 05, 2005 2:35 am
Posts: 7
If the system name returned from WMI is blank, then on line 355 when nslookup function is called, the audit hangs waiting for nslookup.exe to return.

-Randy


Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Tue Feb 20, 2007 11:55 am 
Do you have a dns server with entries for all pc's? If you are running AD and a windows server is doing dhcp, dns should be automatically updated for each computer.


Top
  
Reply with quote  
 Post subject:
PostPosted: Wed Feb 21, 2007 2:08 am 
Offline
Newbie

Joined: Fri Aug 05, 2005 2:35 am
Posts: 7
Thanks for the reply.

The DNS server isn't the problem I'm afraid. On line 336, you get the system_name from WMI:

Code:
Set colItems = objWMIService.ExecQuery("Select * from Win32_ComputerSystem",,48)
For Each objItem in colItems
   system_name = objItem.Name
   domain = objItem.Domain
Next


Under certain error conditions, the value returned by WMI is an empty string. When that empty string is passed to the nslookup function on line 359:

Code:
ns_ip = NSlookup(system_name)


The nslookup program stops at it's command prompt because it was not given a system name. I imagine this isn't a problem for everybody, but we audit approximately 4000 PC's and it manages to occur at least a few times on every pass of the domain. This takes up a few of the "threads" each pass until all 20 spawned audits that we allow are tied up waiting for nslookup to return.

Seems like a check for a blank name or a check for an error should be added before running the nslookup.

Let me know if you need further info.

-Randy


Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Wed Feb 21, 2007 3:03 am 
Can you perhaps find out why there is no name returned? It's kind of good to have a system name to be able to find a system later, etc. Search for WMI Browser and see if you can use that to figure anything out.


Top
  
Reply with quote  
 Post subject:
PostPosted: Wed Feb 21, 2007 8:11 am 
Offline
Newbie

Joined: Fri Aug 05, 2005 2:35 am
Posts: 7
Originally most errors were due to some problem or another with WMI, but those have been resolved.

Now the problem is intermittent, probably due to timing out or other issues related to some of our lower bandwidth or less reliable connections to remote sites.

I would suggest that if a name is not returned from WMI that the audit fail or something similar.

-Randy


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 5 posts ] 

All times are UTC + 10 hours


Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group