FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
Andy_G
Staff
Staff
Article Id 195345

Description

Problem

Windows Servers show duplication in 4.4.2+ version of AO after a rediscovery.  Reason why this happens is due to a new property that we're pulling. VM Hardware or Hardware serial from Windows Servers.

 

This creates a new key that AO is unable to merge with.

 

Here are steps to resolve

1 - Make sure you re-discover all your windows servers so they all duplicate

2 - Once your windows environment shows duplication through the CMDB you are ready to rectify.

 

Part 1 - Log onto the Supervisor and shut down all services

1 - ssh into the supervisor

2 - service crond stop

3 - killall -9 phwatchdog

4 - phtools --stop all

5 - service httpd stop

6 - killall -9 java

7 - phstatus  ##make sure everything is offline, only service should be up is Node.js and dbsvr

 

Part 2 - download the script to de-duplicate the windows servers

1 - Download the script from this page

NOTE: If you have collectors, please download:

delete_dup_winserver_wCollectors.sql

NOTE: If you do NOT have collectors, please download:

delete_dup_winserver_wo_Collectors.sql

 

Part 3 - Upload the script to the supervisor and run the script

1 - Upload the script to the supervisor under /tmp/

2 - run the following line:

With Collectors: psql -U phoenix -d phoenixdb -f /tmp/delete_dup_winserver_wCollectors.sql

Without Collectors: psql -U phoenix -d phoenixdb -f /tmp/delete_dup_winserver_wo_Collectors.sql

3 - This will take a long time (depending on how many windows servers you have to remove)

 

Part 4 - Upkeep after the deduplication

1 - rm -rf /opt/phoenix/cache/<IP_OF_SUPER>

2 - rm /data/cache/worker_mon_job.xml

3 - service crond restart

4 - su admin

5 - phstatus to verify all the services that should come back up within 5-10 minutes time.

 

CAVEAT - If you have workers and/or collectors:

A - Log into each worker and/or collector as root:

B - killall -9 phMonitor phPerfMonitor phAgentManager

 

Contributors