Open-AudIT

What's on your network?
It is currently Fri Apr 27, 2018 4:47 am

All times are UTC + 10 hours




Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 37 posts ]  Go to page 1, 2, 3  Next
Author Message
PostPosted: Wed May 23, 2012 1:15 am 
Offline
Newbie

Joined: Tue Mar 09, 2010 3:02 am
Posts: 32
Perhaps I have something configured incorrectly, but here goes...

I have been running v2 for a while now, and while it is mostly awesome, I am finding some problems that make it less than a reliable source to query data from.

My primary system I run audits on quite frequently, testing this and that, and I have come to find that there are a number of systems that do not seem to post their updated data to the site if the data already exists. I have checked and confirmed that the audits are being pushed up (via the audit log). I have also checked and confirmed that certain software exists on my machine, but is not showing up in the site.

For instance, we have recently upgraded Office Communicator to Lync 2010, but despite having installed this about 4 weeks ago, my system does not report that it has Lync, nor does it report that Communicator has been removed. In addition, I have recently began changing descriptions on all machines via a script, but the description field has only been updated on 2 of my 725 systems despite each being audited after the change.

Have I not changed something in the audit file correctly? Or is this a bug?


Top
 Profile  
Reply with quote  
PostPosted: Wed May 23, 2012 1:34 am 
Offline
Newbie

Joined: Tue Mar 09, 2010 3:02 am
Posts: 32
I have just checked the txt file generated by a manual audit, and while the new description shows in the audit file, it does not appear on the site.

Also, Lync did not appear at all in the audit file.


Top
 Profile  
Reply with quote  
PostPosted: Wed May 23, 2012 2:04 am 
Offline
Newbie

Joined: Tue Mar 09, 2010 3:02 am
Posts: 32
One last update... checking the DB, there are roughly 300-400 systems with updated descriptions. Still only 2 show up on the site though.


Top
 Profile  
Reply with quote  
PostPosted: Wed May 23, 2012 3:48 am 
Offline
Newbie

Joined: Tue Mar 09, 2010 3:02 am
Posts: 32
Another note... After deleting my system, and performing an audit afterwards, the Description field gets updated.

Still not picking up Lync however.


Top
 Profile  
Reply with quote  
PostPosted: Wed May 23, 2012 8:54 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1254
Is Lync installed per-user? OA doesn't audit per-user software.


Top
 Profile  
Reply with quote  
PostPosted: Wed May 23, 2012 10:29 pm 
Offline
Site Admin
User avatar

Joined: Mon Jun 07, 2004 11:48 am
Posts: 1944
Location: Brisbane, Australia
Try running an audit set to offline, then open the text file and paste the contents into the index.php/system/add_system text box (just go to menu -> admin -> system -> add a system).

Maybe there are some nasty characters in the generated XML that are causing the submitted audit to fail (invalid XML).

also, try activating and running the Failed Audits report on a Group that you know contains systems that aren't appearing (even the All Systems group). If they are submitting and have valid XML, but are failing, this should show you which section they are failing on.

_________________
Support and Development hours available from Opmantek.
Please consider a purchase to help make Open-AudIT better for everyone.


Top
 Profile  
Reply with quote  
PostPosted: Wed May 23, 2012 10:32 pm 
Offline
Newbie

Joined: Tue Mar 09, 2010 3:02 am
Posts: 32
jpa wrote:
Is Lync installed per-user? OA doesn't audit per-user software.


Nope, Lync is installed in the system. Registers in Add/Remove, etc. Can query it in PowerShell via command:

Get-WmiObject win32_product | Where-Object {$_.Name -like "*Lync*"}


Top
 Profile  
Reply with quote  
PostPosted: Wed May 23, 2012 10:44 pm 
Offline
Newbie

Joined: Tue Mar 09, 2010 3:02 am
Posts: 32
Mark wrote:
Try running an audit set to offline, then open the text file and paste the contents into the index.php/system/add_system text box (just go to menu -> admin -> system -> add a system).

Maybe there are some nasty characters in the generated XML that are causing the submitted audit to fail (invalid XML).

also, try activating and running the Failed Audits report on a Group that you know contains systems that aren't appearing (even the All Systems group). If they are submitting and have valid XML, but are failing, this should show you which section they are failing on.


Ran the failed audit reports, nothing shows up.

Also, have tried running it offline and have run it online and viewed the system. System is showing a log each time it is audited. But search the XML audit results file yields no results for Lync. It finds other things such as office, etc., but Lync continues to be missed. In checking the registry, Lync exists under the following Uninstall info (so definitely installed in the system):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{81BE0B17-563B-45D4-B198-5721E6C665CD}

So at this point, while the problems are similar, they are different:

1) The description finally was updated once the system was deleted at the website level and re-audited. Not a fix really, but for whatever reason, the data isn't being overwritten.

2) The absence of Lync 2010 in the audit was not corrected by deleting the system at the website level and performing a re-audit. Note that there are still 21 systems that pick it up without issue, some are missing. I intend to run a manual PowerShell audit to get results in a simple fashion, for comparison's sake.


Top
 Profile  
Reply with quote  
PostPosted: Wed May 23, 2012 10:46 pm 
Offline
Newbie

Joined: Tue Mar 09, 2010 3:02 am
Posts: 32
One last note, I will be downloading the latest audit script and testing to see if that goes any different. Should rule out any problems with my script.

EDIT: Just ran it. Get a type mismatch on RPK.


Top
 Profile  
Reply with quote  
PostPosted: Thu May 24, 2012 1:11 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1254
OA skips auditing software in the Uninstall registry key if DisplayName is empty. What does the Lync uninstall registry info look like at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{81BE0B17-563B-45D4-B198-5721E6C665CD}?


Top
 Profile  
Reply with quote  
PostPosted: Thu May 24, 2012 5:33 am 
Offline
Newbie

Joined: Tue Mar 09, 2010 3:02 am
Posts: 32
jpa wrote:
OA skips auditing software in the Uninstall registry key if DisplayName is empty. What does the Lync uninstall registry info look like at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{81BE0B17-563B-45D4-B198-5721E6C665CD}?


Appears as follows:

DisplayName - REG_SZ - Microsoft Lync 2010


Top
 Profile  
Reply with quote  
PostPosted: Thu May 24, 2012 5:44 am 
Offline
Newbie

Joined: Tue Mar 09, 2010 3:02 am
Posts: 32
jpurcell wrote:
One last note, I will be downloading the latest audit script and testing to see if that goes any different. Should rule out any problems with my script.

EDIT: Just ran it. Get a type mismatch on RPK.


Commented out the RPK bit, and still no update to Lync on the site.


Top
 Profile  
Reply with quote  
PostPosted: Thu May 24, 2012 6:58 am 
Offline
Site Admin
User avatar

Joined: Mon Jun 07, 2004 11:48 am
Posts: 1944
Location: Brisbane, Australia
Quote:
1) The description finally was updated once the system was deleted at the website level and re-audited. Not a fix really, but for whatever reason, the data isn't being overwritten.


That is actually by design.
How it works is: (and this applies to a few items in the System table - see below).
Initial audit populates the description and man_description fields.
Subsequent audits don't populate man_description.
The web pages always show man_description.
This is so that if the audit returns data that you consider incorrect (or inaccurate or don't want displayed or whatever), you can over write it and have your changes stay stored.

Other fields that do the same thing are:
man_os_group
man_os_family
man_os_name
man_domain
man_serial
man_model
man_manufacturer
man_form_factor

Those are the fields you see in the web pages, not their audit obtained equivalents (serial, model, et al). I probably need to enable editing of a couple of these in the System Display page (I don't think you can edit them all at the moment).

There is also the "special" case of man_ip_address. If the IP address from the audit result is taken from DHCP, then man_ip_address is updated. If it's not taken from DHCP (see: a server with a static IP), then it is initially populated but left alone on subsequent audits.

OK, so how to solve your issue with this. I don't want to over write them if blank because that is deliberately by design. We do actually store the info in the fields each time we process an audit (serial, description, etc). Because I usually think along the lines of "but what if I have to update 1,000 of these" versus "I just need to update 2 or 3".

Option 1:
Maybe a switch somewhere to say "over write all info in man_* fields regardless".

Option 2:
Maybe put something on the "bulk edit" page (when you select more than one system from a report and edit it) to say "revert this field to the audit contents" - that could apply to each field as above.

_________________
Support and Development hours available from Opmantek.
Please consider a purchase to help make Open-AudIT better for everyone.


Top
 Profile  
Reply with quote  
PostPosted: Thu May 24, 2012 7:00 am 
Offline
Site Admin
User avatar

Joined: Mon Jun 07, 2004 11:48 am
Posts: 1944
Location: Brisbane, Australia
Quote:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{81BE0B17-563B-45D4-B198-5721E6C665CD}


Can you export that key from the registry and post it here?
I don't think it would contain any sensitive information.

_________________
Support and Development hours available from Opmantek.
Please consider a purchase to help make Open-AudIT better for everyone.


Top
 Profile  
Reply with quote  
PostPosted: Wed May 30, 2012 1:28 am 
Offline
Newbie

Joined: Tue Mar 09, 2010 3:02 am
Posts: 32
Here you go:

Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{81BE0B17-563B-45D4-B198-5721E6C665CD}
Class Name: <NO CLASS>
Last Write Time: 5/11/2012 - 1:35 PM
Value 0
Name: AuthorizedCDFPrefix
Type: REG_SZ
Data:

Value 1
Name: Comments
Type: REG_SZ
Data:

Value 2
Name: Contact
Type: REG_SZ
Data:

Value 3
Name: DisplayVersion
Type: REG_SZ
Data: 4.0.7577.4061

Value 4
Name: HelpLink
Type: REG_SZ
Data:

Value 5
Name: HelpTelephone
Type: REG_SZ
Data:

Value 6
Name: InstallDate
Type: REG_SZ
Data: 20120403

Value 7
Name: InstallLocation
Type: REG_SZ
Data: C:\Program Files (x86)\Microsoft Lync\

Value 8
Name: InstallSource
Type: REG_SZ
Data: \\fileserver\apps$\Microsoft\lync 2010\Microsoft-Lync-2010-x64-4-0-7577-4061-EN-US-R1\

Value 9
Name: ModifyPath
Type: REG_EXPAND_SZ
Data: MsiExec.exe /X{81BE0B17-563B-45D4-B198-5721E6C665CD}

Value 10
Name: NoModify
Type: REG_DWORD
Data: 0x1

Value 11
Name: Publisher
Type: REG_SZ
Data: Microsoft Corporation

Value 12
Name: Readme
Type: REG_SZ
Data:

Value 13
Name: Size
Type: REG_SZ
Data:

Value 14
Name: EstimatedSize
Type: REG_DWORD
Data: 0x13aa5

Value 15
Name: UninstallString
Type: REG_EXPAND_SZ
Data: MsiExec.exe /X{81BE0B17-563B-45D4-B198-5721E6C665CD}

Value 16
Name: URLInfoAbout
Type: REG_SZ
Data: http://www.microsoft.com

Value 17
Name: URLUpdateInfo
Type: REG_SZ
Data:

Value 18
Name: VersionMajor
Type: REG_DWORD
Data: 0x4

Value 19
Name: VersionMinor
Type: REG_DWORD
Data: 0

Value 20
Name: WindowsInstaller
Type: REG_DWORD
Data: 0x1

Value 21
Name: Version
Type: REG_DWORD
Data: 0x4001d99

Value 22
Name: Language
Type: REG_DWORD
Data: 0x409

Value 23
Name: DisplayName
Type: REG_SZ
Data: Microsoft Lync 2010


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 37 posts ]  Go to page 1, 2, 3  Next

All times are UTC + 10 hours


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB® Forum Software © phpBB Group