Application Linux Red Hat with WMI evidence

[FrankvH]

Hello,

I found on almost all our Linux server the application "linux" this has only WMI evidence. I found on one of the servers that it found a WMI entry : MGS_OperatingSystem Caption Red Hat Linux

Can somebody explain how the WMI is inventored on a linux server?

Regards

Frank

[mfranz]

Hi Frank,

As can be seen from the class name, this is not a real WMI class, like all classes starting with "MGS" (ManageSoft). MS SQL Server is another good example where you will usually find custom WMI classes.

WMI offers a more complex structure (both in ndi files and the FNMSInventory database) and therefore allows more complex recognition than installers.

On Linux, there is no WMI, but to keep the complexity low, the same data structure as well as recognition logic is reused.

Another example, but in the other direction: There is no Registry on linux, still settings are the same for Windows and Linux agents. They are just stored in a file on Linux (I think).

To understand where the Linux agent takes the data from, I recommend " Common: Child Processes on UNIX-Like Platforms" from the Helpnet.

Best regards,

Markward