I support multiple customers for FNMS and I am seeing similar behavior for out-of-date inventory. The device won't have any updated inventory for months but the history shows changes more recent than the last inventory date. For instance I have a device that has a last inventory date of 10/30/2020, but has links, unlinks, and deletions in the history. I attached a screenshot specific to Notepad++ on this device that shows it has been unlinked and linked twice after 10/30/2020.
Can anyone shed light on what exactly is being tracked here?
Feb 02, 2021 09:31 PM
This behavior is by design.
Based on the most recent evidence data found in the Inventory source, FNMS dynamically links applications to devices during the compliance import process. Evidence data may change daily, as software is being installed or uninstalled on devices.
For the application recognition process, the date when the evidence has been collected for a device does not matter.
As a best practice, you should check the out-of-date inventory on a regular basis and change its state from 'Active' to 'Ignored' when the device has been retired.
Feb 03, 2021 12:34 AM
Thanks for the reply @statler but Im not sure this addresses my situation. This device is no longer on the network and has not been on the network for months yet FNMS is still linking and unlinking evidence from the device. No evidence would have been imported from this device since the last inventory date. This is where my confusion lies.
Feb 03, 2021 12:59 AM
Did you change the status of the Inventory from 'Active' to 'Ignored' already?
FNMS will not automatically disregard any Inventory just because it has not been updated for months. The Inventory record will remain active indefinitely.
You have to manually change the status of the Inventory, or delete it from the underlying Inventory data source. You can automate this process using a SQL or PowerShell script that runs on a regular basis. There are some sample scripts available here on the Community.
Feb 03, 2021 07:15 AM
Feb 03, 2021 07:22 AM
I think what statler meant: Even if the inventory did not change, the ARL may have change. That *could* lead to new applications being found on old inventories.
Feb 03, 2021 07:22 AM
@mfranz I agree this seems most likely to be the case. It seems strange to me that NP++ would have changes that often to the ARL, but I do agree that this is the most likely scenario as its the only changing variable for this device since its offline.
Feb 04, 2021 09:27 AM