Beyond this I'm having trouble auditing Win 7 boxes because of bad partition values.
Audit data like this: [code] <partition> <hard_drive_index></hard_drive_index> <partition_mount_type>mount point</partition_mount_type> <partition_mount_point>\\?\Volume{9ac4466c-9865-11e0-be86-806e6f6e6963}\</partition_mount_point> <partition_name>System</partition_name> <partition_size>6251</partition_size> <partition_free_space>6178</partition_free_space> <partition_used_space>73</partition_used_space> <partition_format>NTFS</partition_format> <partition_caption>\\?\Volume{9ac4466c-9865-11e0-be86-806e6f6e6963}\</partition_caption> <partition_device_id></partition_device_id> <partition_disk_index></partition_disk_index> <partition_type>volume</partition_type> <partition_quotas_supported></partition_quotas_supported> <partition_quotas_enabled></partition_quotas_enabled> <partition_serial>317035552</partition_serial> </partition>[/code]
Produces errors like this: [code]A Database Error Occurred
Error Number: 1452
Cannot add or update a child row: a foreign key constraint fails (`oav2/sys_hw_partition`, CONSTRAINT `sys_hw_partition_hard_drive_index` FOREIGN KEY (`hard_drive_index`) REFERENCES `sys_hw_hard_drive` (`hard_drive_index`))
INSERT INTO sys_hw_partition ( system_id, hard_drive_index, partition_mount_type, partition_mount_point, partition_name, partition_size, partition_free_space, partition_used_space, partition_format, partition_caption, partition_device_id, partition_disk_index, partition_bootable, partition_type, partition_quotas_supported, partition_quotas_enabled, partition_serial, timestamp, first_timestamp ) VALUES ( '67', '', 'mount point', '\\\\?\\Volume{9ac4466c-9865-11e0-be86-806e6f6e6963}\\', 'System', '6251', '6178', '73', 'NTFS', '\\\\?\\Volume{9ac4466c-9865-11e0-be86-806e6f6e6963}\\', '', '', '', 'volume', '', '', '317035552', '2011-08-11 15:59:14', '2011-08-11 15:59:14') [/code]
|