Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 2 subscribers
  • Views 3259 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Doubling up on Devices

Weeboo

I decided to try deleting all of our devices from the enterprise console and set Sophos a task of re-finding everything again - hopefully reducing the number of redundant items

However, it is detecting everything twice - we have double the number of items that we had previously

Is this a known issue ?



This thread was automatically locked due to age.
Parents
  • 0

    Hello Weeboo,

    can't say what exactly happened so I'll give some background:

    1. when a managed version of SESC is installed by whatever means the endpoint contacts and registers with the server, subsequently it appears as manged computer in the console
    2. when you discover, find, import, sync unmanaged computers appear
    3. when a computer is deleted actually a flag is set, it's not visible and not counted for the various totals and statistics

    In cases 1 and 2 a matching algorithm tries to determine if the "new" computer is possibly an already known one. Say you reimage a computer, same name as before; it has never registered but when doing so it presents known attributes - so the "old" and "new" computer are merged into one object. The algorithm considers also "deleted" computers, although with lower priority.

    So, basically there are two sources of computer objects: endpoint-registration and find/discover/import. But: If the attributes don't sufficiently match you'll end up with two computers - same name but subtle differences. If "something" caused redundant items you have to make sure that the cause is gone - otherwise you'll be in the same situation as before.

    If you want a clean start without reinitializing the whole database you'd have to SQL DELETE (unsupported) all computers except the management server and SUMs and then let all the endpoints register themselves without any "detection".

    Christian

Reply
  • 0

    Hello Weeboo,

    can't say what exactly happened so I'll give some background:

    1. when a managed version of SESC is installed by whatever means the endpoint contacts and registers with the server, subsequently it appears as manged computer in the console
    2. when you discover, find, import, sync unmanaged computers appear
    3. when a computer is deleted actually a flag is set, it's not visible and not counted for the various totals and statistics

    In cases 1 and 2 a matching algorithm tries to determine if the "new" computer is possibly an already known one. Say you reimage a computer, same name as before; it has never registered but when doing so it presents known attributes - so the "old" and "new" computer are merged into one object. The algorithm considers also "deleted" computers, although with lower priority.

    So, basically there are two sources of computer objects: endpoint-registration and find/discover/import. But: If the attributes don't sufficiently match you'll end up with two computers - same name but subtle differences. If "something" caused redundant items you have to make sure that the cause is gone - otherwise you'll be in the same situation as before.

    If you want a clean start without reinitializing the whole database you'd have to SQL DELETE (unsupported) all computers except the management server and SUMs and then let all the endpoints register themselves without any "detection".

    Christian

Children
No Data
Unfiltered HTML