{"id":1619,"date":"2021-01-27T16:01:54","date_gmt":"2021-01-27T08:01:54","guid":{"rendered":"http:\/\/blog.infinity.idv.tw\/?p=1619"},"modified":"2021-01-27T16:01:54","modified_gmt":"2021-01-27T08:01:54","slug":"openaudit%e8%92%90%e9%9b%86%e9%9b%bb%e8%85%a6%e8%b3%87%e6%96%99%e8%a2%ab%e5%85%b6%e4%bb%96%e4%b8%8d%e5%90%8c%e9%9b%bb%e8%85%a6%e8%b3%87%e6%96%99%e8%a6%86%e8%93%8b%e7%9a%84%e5%95%8f%e9%a1%8c%e5%85%a9","status":"publish","type":"post","link":"http:\/\/blog.infinity.idv.tw\/?p=1619","title":{"rendered":"OpenAudIT\u8490\u96c6\u96fb\u8166\u8cc7\u6599\u88ab\u5176\u4ed6\u4e0d\u540c\u96fb\u8166\u8cc7\u6599\u8986\u84cb\u7684\u554f\u984c(\u5169\u53f0\u8cc7\u6599\u53ea\u5269\u4e0b\u4e00\u53f0)"},"content":{"rendered":"

#\u82e5\u9084\u6709\u6bd4\u5c0d\u8cc7\u6599\u6703\u9020\u6210\u8a2d\u5099\u8cc7\u6599\u88ab\u8986\u84cb\u7684\u554f\u984c\u5728\u628a\u6bd4\u5c0d\u53c3\u6578\u95dc\u9589\u5373\u53ef
\u5927\u6982\u627e\u5230\u554f\u984c\u4e86\uff0c\u6bd4\u5c0d\u689d\u4ef6\u53ea\u7528TYPE+SERIAL\u914d\u5c0d\uff0c\u5c31\u6703\u9020\u6210\u8986\u84cb\u554f\u984c\u3002<\/font><\/p>\n

\"clip_image002\"<\/font><\/a><\/p>\n

<\/font><\/p>\n

\u5230\u8a2d\u5b9a\u5217\u8868<\/font><\/p>\n

\"clip_image003\"<\/font><\/a><\/p>\n

<\/font><\/p>\n

\u627e\u5230\u6bd4\u5c0d\u51fa\u554f\u984c\u7684\u53c3\u6578<\/font><\/p>\n

\"clip_image005\"<\/font><\/a><\/p>\n

<\/font><\/p>\n

\u95dc\u9589\u6b64\u53c3\u6578<\/font><\/p>\n

\"clip_image007\"<\/font><\/a><\/p>\n

………………………
<\/font><\/p>\n

\u67e5\u8a62\u8a2d\u5099\u8f49\u5165\u6bd4\u5c0d\u4f9d\u64da<\/font><\/p>\n

\u9ede\u9078LOGO\u9032\u5165GROUP \u5217\u8868<\/font><\/p>\n

\"clip_image008\"<\/a><\/font><\/a><\/p>\n

<\/font><\/p>\n

\u9ede\u9078\u8981 View \u7684\u88dd\u7f6e\u5217\u8868<\/font><\/p>\n

\"clip_image009\"<\/a><\/font><\/a><\/p>\n

<\/font><\/p>\n

\u9ede\u9078DISCOVERY LOG<\/font><\/p>\n

\"clip_image010\"<\/a><\/font><\/a><\/p>\n

<\/font><\/p>\n

\u53ef\u4ee5\u770b\u5230\u958b\u982dMATCH\u7684LOG\uff0c\u539f\u4f86\u662f\u6bd4\u5c0d serial + type \u503c\u914d\u5c0d\u6210\u529f\uff0c\u6240\u4ee5\u4ee5\u70ba\u662f\u540c\u4e00\u7b46\u8cc7\u6599\u8986\u84cb\u904e\u53bb<\/font><\/p>\n

\"clip_image012\"<\/font><\/a><\/p>\n

<\/font><\/p>\n

\u5b98\u65b9\u6587\u4ef6
<\/font>https:\/\/community.opmantek.com\/display\/OA\/Matching+Devices<\/font><\/a><\/p>\n


\u8f6c\u81f3\u5143\u6570\u636e\u7ed3\u5c3e<\/font><\/a><\/p>\n

\u00b7 \u7531 <\/font>Mark Unwin<\/font><\/a>\u521b\u5efa, \u6700\u540e\u4fee\u6539\u4e8e<\/font>\u5341\u6708 17, 2019<\/font><\/a><\/p>\n

\u8f6c\u81f3\u5143\u6570\u636e\u8d77\u59cb<\/font><\/a><\/p>\n

Match Process<\/font><\/p>\n

When Open-AudIT receives data about a device, either by discovering the device during an audit run or by the user importing the device, it must determine if this discovered device matches a device that already exists within its database, or if it is a new device that should be added. Open-AudIT uses a series of twelve property matches to determine this. The Match Rules work as OR comparisons, not AND. This means the first rule that matches a field in the discovered device to one in the dB resolves as an existing device. All Matching Rules have to fail in order for a device to be new and result in a new record being created.<\/font><\/p>\n

Duplicate Devices \/ Missing Devices<\/font><\/b><\/p>\n

It is important to note that when Open-AudIT determines a match any properties set to ‘y’ must match exactly (and not be blank) in order for Open-AudIT to determine that the discovered device matches a device already in the database. If none of the properties marked ‘Y’ match, then a new device entry will be created, which could result in duplicate device entries. In situations where properties are duplicated, for example a dbus_id is copied during a VM clone, then an existing device may incorrectly get overwritten\/updated rather then a new entry being created resulting in missing devices.<\/font><\/p>\n

Devices will not be matched<\/u><\/b> if their status is set to "deleted". Any other status will allow a match to occur.<\/font><\/p>\n

Matching Linux Devices<\/font><\/b><\/p>\n

When matching a Linux based device, we prefer to use the Dbus id concatenated with the hostname. We can also use other options as per the above table, but we can retrieve the Dbus ID without root. To retrieve the UUID (from the motherboard), we need to run dmidecode, which does require root. Unfortunately, when you clone an ESXi guest, the Dbus ID does not get recreated – hence our concatenating this with the hostname. There is a good article linked here that details the why’s of hardware IDs. <\/font>http:\/\/0pointer.de\/blog\/projects\/ids.html<\/font><\/a><\/p>\n

Match Order<\/font><\/p>\n

The logic for device matching is contained in the m_devices.php file, which on a Linux install can be found here: \/usr\/local\/open-audit\/code_igniter\/application\/models\/<\/font><\/p>\n

Matching is conducted in the following order:<\/font><\/p>\n

1. Match the Opmantek UUID (not configurable).<\/font><\/p>\n

2. Match the Google Cloud ID (not configurable).<\/font><\/p>\n

3. match_hostname_uuid<\/font><\/p>\n

4. match_hostname_dbus<\/font><\/p>\n

5. match_hostname_serial<\/font><\/p>\n

6. match_dbus<\/font><\/p>\n

7. match_dns_fqdn<\/font><\/p>\n

8. match_dns_hostname<\/font><\/p>\n

9. match_fqdn<\/font><\/p>\n

10. match_serial_type<\/font><\/p>\n

11. match_serial<\/font><\/p>\n

12. match_sysname_serial<\/font><\/p>\n

13. match_sysname<\/font><\/p>\n

14. match_mac (ip table)<\/font><\/p>\n

15. match_mac (network table)<\/font><\/p>\n

16. match_mac (addresses)<\/font><\/p>\n

17. match_ip<\/font><\/p>\n

18. match_hostname<\/font><\/p>\n

19. match_ip_no_data<\/font><\/p>\n

Matching IP Addresses<\/font><\/b><\/p>\n

As at Open-AudIT 3.3.0 we will be implementing a match routine that essentially says "If all I have is an IP, and that IP belongs to a device in the database and that device has not been audited, match that device regardless of the match_ip rule.<\/font><\/p>\n

The reason for this is in the case of a discovered device that we don’t have credentials for, we have virtually no information except the IP and maybe the DNS Hostname. Neither are considered unique (think DHCP). But in the case where we have a device with that lack of data already preset in the database, assume it is the same device so that we don’t create many false duplicates. This configuration item will be called match_ip_no_data and will be set to YES by default.<\/font><\/p>\n

Match Properties<\/font><\/p>\n

These properties are stored in Open-AudIT’s configuration; to access them select Admin -> Configuration -> Discovery from Open-AudIT’s menu. The default values of ‘y’ and ‘n’ simply mean YES and NO. We will use YES and NO in the description, rather than ‘y’ and ‘n’. The stored value should always be either a lowercase y or n.<\/font><\/p>\n

The properties and their default values are listed below.<\/font><\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n

Property<\/font><\/b><\/p>\n<\/td>\n

\n

Default Value<\/font><\/b><\/p>\n<\/td>\n

\n

Description<\/font><\/b><\/p>\n<\/td>\n<\/tr>\n

\n

Property<\/font><\/b><\/p>\n<\/td>\n

\n

Default Value<\/font><\/b><\/p>\n<\/td>\n

\n

Description<\/font><\/b><\/p>\n<\/td>\n<\/tr>\n

\n

match_dbus<\/font><\/p>\n<\/td>\n

\n

n<\/font><\/p>\n<\/td>\n

\n

Linux based devices only. The DBUS id is supposed to be unique on each Linux device. It is set to NO by default because ESX, upon cloning a guest virtual machine, does not tell the operating system to recreate this identifier. We were receiving reports of discovered devices overwriting one another and this was the culprit.<\/font><\/p>\n<\/td>\n<\/tr>\n

\n

match_fqdn<\/font><\/p>\n<\/td>\n

\n

y<\/font><\/p>\n<\/td>\n

\n

Should we match a device based on its fqdn.<\/font><\/p>\n<\/td>\n<\/tr>\n

\n

match_dns_fqdn<\/font><\/p>\n<\/td>\n

\n

n<\/font><\/p>\n<\/td>\n

\n

Should we match a device based on its DNS fqdn.<\/font><\/p>\n<\/td>\n<\/tr>\n

\n

match_dns_hostname<\/font><\/p>\n<\/td>\n

\n

n<\/font><\/p>\n<\/td>\n

\n

Should we match a device based on its DNS hostname.<\/font><\/p>\n<\/td>\n<\/tr>\n

\n

match_hostname<\/font><\/p>\n<\/td>\n

\n

y<\/font><\/p>\n<\/td>\n

\n

Should we match a device based on its hostname? Set to YES as hostnames should be unique to a network. This may be a candidate for changing as some users may wish to audit disparate networks (say several different customers networks) that contain hostnames that are identical to others already in Open-AudIT. Say ‘web’ or ‘mail’ or ‘dns’, etc. Certain hostnames are not uncommon to use.<\/font><\/p>\n<\/td>\n<\/tr>\n

\n

match_hostname_dbus<\/font><\/p>\n<\/td>\n

\n

y<\/font><\/p>\n<\/td>\n

\n

Linux based devices only. Should we use the combination of the hostname (as determined by Open-AudIT) and DBUS id (as reported by an audit script or SSH command) to determine a device match? Set to YES as this is considered a reliable combination.<\/font><\/p>\n<\/td>\n<\/tr>\n

\n

match_hostname_serial<\/font><\/p>\n<\/td>\n

\n

y<\/font><\/p>\n<\/td>\n

\n

Should we use the combination of the hostname (as determined by Open-AudIT) and serial (as reported by an audit script, SSH command or SNMP query) to determine uniqueness. Set to YES as this is considered a reliable combination.<\/font><\/p>\n<\/td>\n<\/tr>\n

\n

match_hostname_uuid<\/font><\/p>\n<\/td>\n

\n

y<\/font><\/p>\n<\/td>\n

\n

Should we use the combination of the type (as determined by Open-AudIT) and serial (as reported by an audit script, SSH command or WMI command) to determine uniqueness. Set to YES as this is considered a reliable combination.<\/font><\/p>\n<\/td>\n<\/tr>\n

\n

match_ip<\/font><\/p>\n<\/td>\n

\n

n<\/font><\/p>\n<\/td>\n

\n

Should we match based only on the device’s IP address? Set to NO because DHCP will cause false positive matches. This may be acceptable to set to YES if you can guarantee no devices will change IP addresses. You may only ever audit a server network for example. In most cases, it is best to leave this to NO.<\/font><\/p>\n<\/td>\n<\/tr>\n

\n

match_mac<\/font><\/p>\n<\/td>\n

\n

y<\/font><\/p>\n<\/td>\n

\n

Should we match a device based only on it’s discovered MAC addresses. Set to NO prior to 3.3.0. Post 3.3.0 will be set to YES. A MAC address should be unique on a network. See below for an exception to the rule.<\/font><\/p>\n<\/td>\n<\/tr>\n

\n

match_mac_vmware<\/font><\/p>\n<\/td>\n

\n

n<\/font><\/p>\n<\/td>\n

\n

VMware Workstation tends to use MAC addresses that are not globally unique. IE – Two different workstations may be running VMware Workstation and have two different virtual machines that have the same MAC address. These machines won’t ever need to perform networking outside their hosts using this MAC address, but Open-AudIT will discover the MAC addresses upon an audit. Should we determine uniqueness based on these mac addresses? These MAC addresses typically start with one of the following: 00:0c:29, 00:50:56, 00:05:69, 00:1c:14.<\/font><\/p>\n<\/td>\n<\/tr>\n

\n

match_serial<\/font><\/p>\n<\/td>\n

\n

y<\/font><\/p>\n<\/td>\n

\n

Should we use the serial (as reported by an audit script, SSH command, WMI command or SNMP query) to determine a device match? Set to YES as this is considered a reliable attribute.<\/font><\/p>\n<\/td>\n<\/tr>\n

\n

match_serial_type<\/font><\/p>\n<\/td>\n

\n

y<\/font><\/p>\n<\/td>\n

\n

Should we use the combination of the type (as determined by Open-AudIT) and serial (as reported by an audit script, SSH command, WMI command or SNMP query) to determine uniqueness. Set to YES as this is considered a reliable combination.<\/font><\/p>\n<\/td>\n<\/tr>\n

\n

match_sysname<\/font><\/p>\n<\/td>\n

\n

y<\/font><\/p>\n<\/td>\n

\n

Should we match a device based only on its SNMP sysName.<\/font><\/p>\n<\/td>\n<\/tr>\n

\n

match_sysname_serial<\/font><\/p>\n<\/td>\n

\n

y<\/font><\/p>\n<\/td>\n

\n

Should we match a device based only on its SNMP sysName and serial.<\/font><\/p>\n<\/td>\n<\/tr>\n

\n

match_uuid<\/font><\/p>\n<\/td>\n

\n

y<\/font><\/p>\n<\/td>\n

\n

Should we use the UUID (as reported by an audit script, SSH command or WMI command) to determine a device match? Set to YES as this is considered a reliable attribute.<\/font><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"

#\u82e5\u9084\u6709\u6bd4\u5c0d\u8cc7\u6599\u6703\u9020\u6210\u8a2d\u5099\u8cc7\u6599\u88ab\u8986\u84cb\u7684\u554f\u984c\u5728\u628a\u6bd4\u5c0d\u53c3\u6578\u95dc\u9589\u5373\u53ef \u5927\u6982\u627e\u5230\u554f\u984c\u4e86\uff0c\u6bd4\u5c0d\u689d\u4ef6\u53ea\u7528TYPE+SERIAL\u914d\u5c0d\uff0c\u5c31\u6703\u9020\u6210\u8986\u84cb\u554f\u984c\u3002<\/p>\n<\/p>\n

\u5230\u8a2d\u5b9a\u5217\u8868<\/p>\n<\/p>\n

\u627e\u5230\u6bd4\u5c0d\u51fa\u554f\u984c\u7684\u53c3\u6578<\/p>\n<\/p>\n

\u95dc\u9589\u6b64\u53c3\u6578<\/p>\n<\/p>\n

……………………… <\/p>\n

\u67e5\u8a62\u8a2d\u5099\u8f49\u5165\u6bd4\u5c0d\u4f9d\u64da<\/p>\n

\u9ede\u9078LOGO\u9032\u5165GROUP \u5217\u8868<\/p>\n<\/p>\n

\u9ede\u9078\u8981 View \u7684\u88dd\u7f6e\u5217\u8868<\/p>\n<\/p>\n

\u9ede\u9078DISCOVERY LOG<\/p>\n<\/p>\n

\u53ef\u4ee5\u770b\u5230\u958b\u982dMATCH\u7684LOG\uff0c\u539f\u4f86\u662f\u6bd4\u5c0d serial + type \u503c\u914d\u5c0d\u6210\u529f\uff0c\u6240\u4ee5\u4ee5\u70ba\u662f\u540c\u4e00\u7b46\u8cc7\u6599\u8986\u84cb\u904e\u53bb<\/p>\n<\/p>\n

\u5b98\u65b9\u6587\u4ef6 https:\/\/community.opmantek.com\/display\/OA\/Matching+Devices<\/p>\n

\u8f6c\u81f3\u5143\u6570\u636e\u7ed3\u5c3e<\/p>\n

\u00b7 \u7531 Mark Unwin\u521b\u5efa, \u6700\u540e\u4fee\u6539\u4e8e\u5341\u6708 17, 2019<\/p>\n

\u8f6c\u81f3\u5143\u6570\u636e\u8d77\u59cb<\/p>\n

Match Process<\/p>\n

When Open-AudIT receives data about a device, either by discovering the device during an audit run or by the user […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[564],"tags":[656],"_links":{"self":[{"href":"http:\/\/blog.infinity.idv.tw\/index.php?rest_route=\/wp\/v2\/posts\/1619"}],"collection":[{"href":"http:\/\/blog.infinity.idv.tw\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.infinity.idv.tw\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.infinity.idv.tw\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.infinity.idv.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1619"}],"version-history":[{"count":1,"href":"http:\/\/blog.infinity.idv.tw\/index.php?rest_route=\/wp\/v2\/posts\/1619\/revisions"}],"predecessor-version":[{"id":1620,"href":"http:\/\/blog.infinity.idv.tw\/index.php?rest_route=\/wp\/v2\/posts\/1619\/revisions\/1620"}],"wp:attachment":[{"href":"http:\/\/blog.infinity.idv.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1619"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.infinity.idv.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1619"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.infinity.idv.tw\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1619"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}