Two computers wuth the same name

Hello

The Enterprise console will use both IP and computername for unique references

the first one disappear from the console and now i can't find it

Where did you look for it :smileywink:?

Seriously - most of the time I thought a computer had "disappeared" it was due to either being in a sub-view (that is: I had selected a group/the wrong group, something else than All computers was selected for View: or the view was sorted by something other than Computer name). I have not yet found out  (and haven't tried to) what makes a computer really "unique" - but once it's officially part of the Remote Management System it may change name, workgroup and/or IP address (joining a domain is a different story).

Unless it's a trade secret I'd like to see a description of how a computers identity is determined (one thing I know is: if you "clone" an image after Sophos has been installed the computers have the same identity ...). And is it kept if Sophos is uninstalled and then reinstalled?

You can (unsupported) look what's in the database with something like this:

osql -E -S . -d SOPHOS4 -Q "SELECT ID,Name,DomainName,IPAddress,MessageSystemAddress,Deleted FROM ComputersAndDeletedComputers ORDER BY Name" -w 1200 -o C+dC.txt

If you still can't find it ... I'll have to start thinking :smileyhappy:

Christian

I have checked all the views. I have executed the query. I am absolutely sure: The first computer have vanished.

I hadnt thought about cloning computers, but it is a good point. So... Does anybody know how the computers are identified?

The console displays computers by name. We've supplied switches for setup to accomodate the possibility of two managed computers in the console with the same hostname. The -compname switch is what you'd want to use. The full list of switches can be found at http://www.sophos.com/support/knowledgebase/article/12570.html You'd need to rerun the setup.exe with the appropriate switches to force a client to show in the console with a different hostname.

I can more or less confirm this for new installations - it looks indeed like same name overwrites (but identical hostnames already in the database stay). I think this behaviour can cause problems: recently a number of computers has been installed for a specific project and the assigned names had 17 characters - unfortunately they differed only in the last two. Sophos uses the NetBIOS names which are only 15 characters - so instead of 8 only  1 computer "showed up".

When was this introduced (as I said, I do have identical hostnames in SEC)?

Christian

Sorry for the incorrect information, Toxo.

I verified that a known MessageSystemAddress takes precedence - thus cloned computers will appear as one with constantly changing attributes and accumulated errors/alerts.

Note: I'm talking about installing Sophos on the client - not from SEC (either by Protect Computers or AD sync)

I'm an ignorant when it comes to SQL  but I can tell that the ComputerAdd stored procedure has changed (I didn't doubt that you are right, Nathan). If ComputerAdd is indeed the one called when a new computer registers with the console the I can see it will "replace" a computer with the same name when there is no domain/workgroup (e.g. linux) or when domain/workgroup also matches.  Can't see where it would do so if the workgroups differ.

Anyway - if a computer is "replaced" when the name matches then it could a problem: we don't have administrative rights over most of our clients (this a university ...), users download an installer package. We can neither enforce a certain name on the computer nor use the setup switch. And given that users often don't care about the workgroup it's not unlikely they also match.

Admittedly I have only a handful of "pairs" among some 2000 managed computers (not counting the "army of clones" which is out there - they are much more of a problem) - still, it's not perfect.

Christian

Thank you for your help.

I'm using the compname parameter for registering the computer with a specific name. Now all the computers are in the console.

But a new problem arises. I am checking the new installed computers with the EICAR virus. When I receive the email alert I don't get the computer name that I used for registering. I get only the computer name. I mean: I have two computers registered as WG1\PC1 and WG2\PC1. The computer name in the email alert is PC1.

My question is: Can I customize the email notification to add a parameter that identifies the computer, such as the IP address, workgroup\computername, ...?

Thank you again.