Open-AudIT

Currently I have this software setup on a server and set to run a full domain audit (roughly 500 PCs) every Sunday. I also have a GP set so that a machine is audited whenever a user logs into the machine. I am using this setup becase we have more than a few users who rarely if ever logoff their workstation and therefore the system would never get audited.

Today I was browsing through some of the data and I noticed that there were software counts higher than the number of PCs we have on the network. After looking at the software list w/ hosts, I noticed that hosts were being listed twice or more for the same piece of software.

I have two different configurations for the audit script. One is setup for the login script audit which has a couple things disabled:


login script config // server remote audit config
=============================
audit_location = "r" // "l"
str_computer = "." // ""
audit_local_domain = "n" // "y"


I am also using the yesxml setting only because I wanted to make sure everything was happening "behind the scene" at a user level, however I may be changing that to "ie" because of some posts I read about the yesxml not properly submitting some characters in software names.

If I can fix this without having to wipe the database and start over I would appreciate it, but it's not that big of a problem if it has to be done.

Thanks in advance.

I'm guessing this is:
http://www.open-audit.org/phpbb2/viewtopic.php?t=1302

A few people seem to be having this problem but at the moment we're struggling to find out what is causing the problem! I haven't been able to duplicate the problem so if you can find a test case that causes duplication that would be very useful.

Sorry this isn't much help!

Thanks for the info. I'll read through that post when I have time. Also over the next week I'll sort through some of these dupes and see if I can come up with any correlation between how the audits are being ran, pc setups, software names, etc. and I'll keep you guys updated.

In particular can you look at the uuid of the items in question.

I think we are seeing duplicates because we create duplicate machine records.

I see my laptop in the database twice (or more), each time with a different UUID. Can you look at the software items in question. (Try the Admin > Backup Database> facility in the latest SVN version to list your database to a SQL file (which is a text file), then look through the records with a wordpad or similar for duplicates, and see if you can find a pattern).

NOTE: The backup facility is still being tested so use with caution.

I've just been doing some manual sql queries to compare some data. From what I can tell, there are never more than 2 instances of the same software, meaning it's only listed as being installed on a system a max of twice.

Both records are being updated when an audit is performed.

The "latest" software record seems to be timestamped on the day I attempted to run a full domain audit, which was successful (well.. sorta )

I've gone through my 2 configs again and unless I changed something and can't remember it the differences are as follows:

login script config -- located on primary domain controller
-----------------------------------
audit_location = "r"
audit_local_domain = "n"
strComputer = "."

domain audit config -- located on openaudit server
-----------------------------------
audit_location = "l"
audit_local_domain = "y"
strComputer = ""



What I may try doing is nuking the database and then running some tests of login vs domain audit. I have also added some code to the audit.vbs script so that it dumps the collected software name, uuid, version, timestamp and sql query into a log file when it fails to update the software record (thinks it needs to add a new software record.)

[quote="bhhandley"]...

What I may try doing is nuking the database and then running some tests of login vs domain audit. I have also added some code to the audit.vbs script so that it dumps the collected software name, uuid, version, timestamp and sql query into a log file when it fails to update the software record (thinks it needs to add a new software record.)

Please could you let me know if the latest fix has solved this issue for you bhhandley.