How Discovery Works

Understanding what Open-AudIT does during a discovery helps you troubleshoot problems, tune performance, and set realistic expectations. Here's a look at the process from start to finish.

The High-Level Process

When you click Execute on a discovery, Open-AudIT spawns a background process and returns you to the discovery details page immediately (so you're not sitting there waiting). That background process then:

1. Runs an Nmap command to identify live IP addresses in the range
2. Places each live IP into a processing queue
3. Spawns up to 20 parallel worker processes (configurable via discovery_limit) to scan each IP

Each worker process handles one IP at a time, working through the steps below.

Per-Device Steps

Step 1: Port Scan

Nmap scans the top 1,000 TCP ports on the device, plus UDP port 161 (SNMP) and UDP port 62078 (Apple iOS). Based on what responds, Open-AudIT determines which protocol to use:

• Port 22 open → try SSH
• Port 135 open → try WMI (Windows)
• UDP 161 open → try SNMP

Step 2: SNMP

If SNMP is available, Open-AudIT queries the device first. SNMP gives basic device information and works on almost everything — routers, switches, printers, Linux servers, and Windows machines with SNMP enabled.

Step 3: SSH

SSH is next. Open-AudIT supports both password and key-based authentication. For best results, use the root user or a sudo-enabled account. On Linux systems where sudo without a TTY is blocked, you'll need root credentials to get a complete audit.

If a Windows machine is running SSH, Open-AudIT detects this and switches to WMI instead.

Step 4: WMI

WMI (Windows Management Instrumentation) is used for Windows devices. An account with Administrator-level access is required for complete results.

Step 5: Audit Script

Once the initial connection is made, Open-AudIT copies the appropriate audit script to the device and runs it:

• On Linux/SSH: the script is copied to /tmp/ (configurable via discovery_linux_script_directory) and executed remotely. The device audits itself, generates an XML result file, and Open-AudIT retrieves and deletes it.
• On Windows/WMI from a Linux server: the script is copied via SMB and executed remotely.
• On Windows/WMI from a Windows server: the script runs directly.

Supported operating systems for full audit scripts: Windows, Linux, macOS, AIX, HP-UX, Solaris, and ESXi.

The audit script is self-deleting on the target — it removes itself after running.

Step 6: Data Processing

The returned audit results are matched against existing devices in the database (see Matching Devices). If a match is found, the record is updated. If not, a new device record is created.

How Long Does it Take?

The honest answer: it depends. Factors include:

• Number of IPs in the scan range
• Network speed and latency
• Number of unique credentials being tested
• Device response times
• Type of devices (full OS audit takes longer than SNMP-only)

A practical guideline: keep discoveries to /24 subnets (256 IPs). Open-AudIT can handle larger ranges (customers have successfully scanned /16 subnets with 65,000+ IPs), but /24 blocks are far more manageable and easier to troubleshoot.

Useful Configuration Items