Why the actor of CI updates is identified as system

[mugi-san]

Hello, Everyone.

Based on our investigation, we suspect that the "CMDB Health Dashboard - Correctness Score Calculation" logic, which automatically creates duplicate remediation tasks, caused the discovery source to be updated to "Unknown" by "system." Since this specific update does not appear in the audit logs, the investigation has been quite challenging.

According to other KB articles, this scheduled job is known to update CIs this way when generating duplicate remediation tasks via CI Identification Rules.
[KB0695325 discovery_source field is switching between "unknown" and empty values]

​Does anyone know why this only applied to a handful of CIs instead of all records that qualify as duplicates under the identification rules?

For example, are there any additional rules, such as options or properties outside of the CI Identification Rules, that control which records are targeted? If you have any experience or creative solutions for preventing records from being updated by "system" without appearing in the audit logs, I would greatly appreciate it if you could share your insights.

Regards.

[mugi-san · Accepted solution]

Hi, Everyone.

The target CIs were those with an empty Discovery Source and fewer than five duplicate records based on Independent Identification Rules. It should be noted that if the identification rule evaluates a combination of fields, those records are not considered duplicates under that specific condition.

Therefore, to calculate the exact numbers, it was necessary to verify both the CI Identification Rules and the value of the glide.identification_engine.skip_duplicates.threshold system property (which defaults to 5).

Regards.