Duplicate systems in the systems tree

[JKBH1]

This just made troubleshooting easier. My computer (not virtual machine) is one of these devices that are showing as "duplicate". My agent GUID is different from the other system but we share the same hostname.

I went on to check the agent log you mentioned and I am not seeing anything in the masvc.log that shows change in GUID:

$ grep -i guid macmnsvc_<MachineName>.log 

2020-04-08 22:07:09.833 (63.291366336) iamclient.Info: Getting agent info from ma ds for id <AgentGuid> data <{1fa9ffdc-ded1-11e9-262c-00e04c19d0d0}>

$ grep -i change macmnsvc_<MachineName>.log 

2020-04-01 23:04:54.545 (63.250701248) msgbus.Info: File watcher callback invoked on broker config change, file name </var/McAfee/agent/.msgbus/config.ini>

2020-04-01 23:04:54.546 (63.250701248) msgbus.Info: File watcher callback invoked on broker config change, file name </var/McAfee/agent/.msgbus/config.ini>

Anything else to check?

[cdinet]

The log that would contain anything about the UUID (not guid, but uuid) would be the masvc log.  

So there are some things you want to look at.  Are the host names really the same where the OS is MAC and Windows?  Is the mac address different or the same?  Is the agent guid the same?  If they are all different, but host name is the same, then it seems to be a valid duplicate entry that is only duplicated by system name, but no other properties.

For systems that are the same OS, some of the same questions - is the agent guid and mac address the same or different?  If you select one system and both are highlighted, are you using custom columns in the system tree?  If so, set the columns to default and see if duplicates go away.  If so, add columns back one at a time to see what property is duplicated.  This is common if there has been an upgrade of a product and some remnants of old version are still being reported.  Essentially, the agent is reporting both versions installed.  If the agent is reporting correct version but epo isn't updating the properties, what is the size of the epocomputerpropsstaging table in the database?  If that is too big, props won't be updated properly.  

There are really a lot of reasons for duplicates, so you want to identify what is common about them and what is different.  Also, to identify whether a system is virtual or physical, you can look at system manufacturer and/or system model - if using VMware, both of those fields will contain the word VMware.

[JKBH1]

Nothing shows up in the masvc log in my computer.

$ grep -i uuid masvc_<MachineName>.log 

For the scenario where the hostname is the same where the OS is Mac and Windows:

1.) MAC addresses are different.

2.) Agent GUIDs are different.

For the scenario where the hostnames is the same where OS is also the same:

1.) It is not consistent. Some have the same MAC addresses, some are showing different MAC addresses.

2.) Although the agent GUIDs are different for the first 4 sections separated by the hyphen, what's common is --- they have the same last set of 12 characters (in numeric form). Sample below:

89F69232-A4F1-22Z1-50TT-0023575C5248

77Z52174-F3O6-32E9-29FD-0023575C5248

From the system tree and searching for a host with a duplicate, it shows the 2 systems with duplicate hostnames. I then went to the Default View. Unfortunately, the duplication doesn't go away; system tree still shows the 2 duplicate systems.

[cdinet]

There is nothing you can do about the mac and windows systems with same name except for change name on one of them or ignore duplication.

89F69232-A4F1-22Z1-50TT-0023575C5248

77Z52174-F3O6-32E9-29FD-0023575C5248

That last section of the agent guid looks like mac address.  Does that match the mac of the systems reporting that?  

As suggested, it might be a good idea to open a ticket with us to help find root cause.  Depending on whether you are using encryption and/or user based policies, or some of these have critical settings in policies, you might not want to just delete the duplicates till we find out what is going on with it.

[JKBH1]

The last section that is common does not refer to the machine's MAC address.

Thanks. I'll move forward with opening a ticket with McAfee support.

I learned a lot with this exchange. Thanks again!