Cadet 1st Class
Cadet 1st Class
570 views

Auto Zone failed : conflicting device

there is a conflicting device with same hostname/Ip address in Zone ...

is there a way to remove duplicates automatically ??

Labels (1)
0 Likes
3 Replies
Cadet 1st Class
Cadet 1st Class

1) i found up to three duplication for one asset

one zoned correctly , one zoned as RFC private and one with no Zone info .

2) Can i delete the assets found under Arcsight administration/Devices ???

0 Likes
Fleet Admiral
Fleet Admiral

Dear Maged Mag,

ArcSight Network Model and Assets is a subject complex.

I had the same problem and according to Support, there is a way to do it but you need to launch a SQL command which could be risky thus it is better to ask to support or PS for this kind of help. To be sure that you will not make mistake.

Firstly check that all connectors has a proper URI and assigned to local zone

Then Switch off Auto asset creation is BEST PRACTICE.

There is a solution to prevent duplicate asset. It is to remove the asset auto-creation on ESM.

There are two filters on ESM to put at false (depends of ESM version😞

/All Filters/ArcSight System/Asset Auto Creation/Connector Asset Auto Creation Controller

/All Filters/ArcSight System/Asset Auto Creation/Device Asset Auto Creation Controller

and one parameter to change in server.properties manager file:

autocreate.sensor.asset.enabled=false

ESM automated asset creation is not reliable and this is why ArcSight Support recommend to use the Asset Import Connector in place of ESM.

Before changing anything ask Support to be sure that this what you need.


You have explanation in the Console User Guide.

They explain how it works following which solution you use to import asset by csv file or by Asset Import connector.


I hope this information will be useful

I have to see PS soon to discuss about this point, if I receive more interesting information I make a feedback on Protect724.


Thanks

Kind Regards


Michael

0 Likes
Fleet Admiral
Fleet Admiral

Hi Maged Mag,

Before deleting asset in Device, you need to disable asset auto-creation because it will recreated later.

You need to be sure what you do before deleting something.

You may delete duplicate item but DO NOT DELETE the folder Devices;

I advice you to read the document Console User Guide on that subject Network Model, Asset Auto-creation, etc..

Thanks

Regards

Michael

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.