Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 2 subscribers
  • Views 3257 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Doubling up on Devices

Weeboo

I decided to try deleting all of our devices from the enterprise console and set Sophos a task of re-finding everything again - hopefully reducing the number of redundant items

However, it is detecting everything twice - we have double the number of items that we had previously

Is this a known issue ?



This thread was automatically locked due to age.
  • 0

    Hello Weeboo,

    can't say what exactly happened so I'll give some background:

    1. when a managed version of SESC is installed by whatever means the endpoint contacts and registers with the server, subsequently it appears as manged computer in the console
    2. when you discover, find, import, sync unmanaged computers appear
    3. when a computer is deleted actually a flag is set, it's not visible and not counted for the various totals and statistics

    In cases 1 and 2 a matching algorithm tries to determine if the "new" computer is possibly an already known one. Say you reimage a computer, same name as before; it has never registered but when doing so it presents known attributes - so the "old" and "new" computer are merged into one object. The algorithm considers also "deleted" computers, although with lower priority.

    So, basically there are two sources of computer objects: endpoint-registration and find/discover/import. But: If the attributes don't sufficiently match you'll end up with two computers - same name but subtle differences. If "something" caused redundant items you have to make sure that the cause is gone - otherwise you'll be in the same situation as before.

    If you want a clean start without reinitializing the whole database you'd have to SQL DELETE (unsupported) all computers except the management server and SUMs and then let all the endpoints register themselves without any "detection".

    Christian

  • 0

    Hi Weeboo,

    Please check the PurgeDB tool to remove the duplicate entries- Using PurgeDB with Enterprise Console.

    purgedb.exe -category=computers -action=delete -HistoryLengthInDays=30

    To find the list of duplicates in database:-

    sqlcmd -E -S .\sophos -d SOPHOS5** -Q "SELECT name, COUNT(name) as Count FROM ComputersAndDeletedComputers where deleted = 0 GROUP BY name HAVING ( COUNT(name) > 1 )"

    If there is still duplicates for machines then we can follow last option as manual cleanup of computers one by one.

    sqlcmd -E -S .\SOPHOS -d SOPHOS5** -Q "delete from computersanddeletedcomputers where name = 'COMPUTERNAME'"

     

    If you need additional assistance with it, please reach out to our support.

    Regards,

    Gowtham Mani
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

Unfiltered HTML