This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Autoupdate: Find specific computer behind an web account

Hi community

We have a Linux Web Box in the DMZ to keep external and private computers up2date with Sophos AutoUpdate.

Because the users use the same account for some private computers, we can't see, which machine get which updates. In our Access-Log file from the Apache web server i just can see an ID:

192.168.6.35 - - [12/Jun/2013:10:45:31 +0200] "GET /sophos/ESXP/sau//cidsync.upd HTTP/1.1" 401 - "-" "SophosAutoUpdate/2.7.4.317 SDDS/1.0 (u=\"sophos_username\" c=\"1d9c35da-d48f-4a8a-8820-d84b0f0f6ea0\")"
192.168.6.35 - sophos_username [12/Jun/2013:10:45:31 +0200] "GET /sophos/ESXP/sau//cidsync.upd HTTP/1.1" 200 6300 "-" "SophosAutoUpdate/2.7.4.317 SDDS/1.0 (u=\"sophos_username\" c=\"1d9c35da-d48f-4a8a-8820-d84b0f0f6ea0\")"

Is someone out there who can explain me this ID, how i can refere to the exact machine behind the username?

Thank a lot

Ivo

This thread was automatically locked due to age.

Parents

0 QC over 10 years ago

Hello Ivo,
the highlighted value is from the endpoint's machine_ID.txt in %ProgramData%\Sophos\AutoUpdate\. Note there's a second machine_ID.txt in %ProgramData%\Sophos\AutoUpdate\data\ which is stored in SEC's database. Unfortunately there's no way to match these two other than inspecting the endpoint.
Christian
:56165
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 QC over 10 years ago

Hello Ivo,
the highlighted value is from the endpoint's machine_ID.txt in %ProgramData%\Sophos\AutoUpdate\. Note there's a second machine_ID.txt in %ProgramData%\Sophos\AutoUpdate\data\ which is stored in SEC's database. Unfortunately there's no way to match these two other than inspecting the endpoint.
Christian
:56165
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data