Open-AudIT

I'm not sure if that applies to ALL VMWare-based systems, or just to my SuSE 11.0 32-bit that is hosted on a 64-bit Linux server.

lshal does not return any smbios information on my VMWare appliance.

Solution: if smbios.system.uuid is empty, use system.hardware.uuid instead. That does exist on my VMWare guest.

This root cause seems to be because some HAL keys were deprecated after a certain version. See ... http://dkukawka.blogspot.com/2008/02/ha ... -keys.html

I modified my audit_linux.sh script to account for it by checking the HAL version then using the deprecated key if it's using an old HAL...

[code]
OA_Trace "Auditor..."

# Audit Information

case $uuid_type in
uuid)
if [ "$OA_HAL_MISSING" != "yes" ] && ! echo "$HAL_VERSION" | $OA_GREP -qE "0\.[0-5]\.([0-9]|10)\.[0-9]"; then
UUID=$($OA_HAL_GET --udi $PC --key system.hardware.uuid)
elif [ "$OA_HAL_MISSING" != "yes" ] && echo "$HAL_VERSION" | $OA_GREP -qE "0\.[0-5]\.([0-9]|10)\.[0-9]"; then
UUID=$($OA_HAL_GET --udi $PC --key smbios.system.uuid)
elif [ "$OA_DMIDECODE_MISSING" != "yes" ]; then
UUID=$($OA_DMIDECODE --string system-uuid)
fi;;
mac)
UUID=$($OA_IFCONFIG eth0 | $OA_AWK '/HWaddr/{print $5}');;
*)
UUID="$HOSTNAME.$NET_DOMAIN";;
esac

# If it fails to set the UUID somehow, set a failsafe one.
if [ "$UUID" = "" ]; then
UUID="$HOSTNAME.$NET_DOMAIN"
fi

AUDIT_DATE="$($OA_DATE +%Y%m%d)$($OA_DATE +%H%M%S)"
DATE="$($OA_DATE +%d/%m/%Y)$($OA_DATE +%H:%M:%S)"
AUDIT_USER=$($OA_WHOAMI)

echo "audit^^^$HOSTNAME^^^$AUDIT_DATE^^^$UUID^^^$AUDIT_USER^^^y^^^y^^^" >> $ReportFile
[/code]

_________________
OA Server: Debian Squeeze w/ Apache2
Auditing: 700 Workstations, 250 or so Retail Terminals, about 75 Servers
OS's: Windows XP/2003/2008/2008 R2/Vista/7, Debian
LDAP: Active Directory 2008 R2