Why the actor of CI updates is identified as "system"
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
2 hours ago
Hi, everyone.
Based on our investigation, we suspect that the "CMDB Health Dashboard - Correctness Score Calculation" logic, which automatically creates duplicate remediation tasks, caused the discovery source to be updated to "Unknown" by "system." Since this specific update does not appear in the audit logs, the investigation has been quite challenging.
According to other KB articles, this scheduled job is known to update CIs this way when generating duplicate remediation tasks via CI Identification Rules.
Does anyone know why this only applied to a handful of CIs instead of all records that qualify as duplicates under the identification rules?
For example, are there any additional rules, such as options or properties outside of the CI Identification Rules, that control which records are targeted?
Regards.
