Duplicate macOS Agents in Console
search cancel

Duplicate macOS Agents in Console

book

Article ID: 374063

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

After a network change (ex: VPN) and a reboot, the macOS Agent is duplicated in the Console.

Environment

  • App Control Agent: All Supported Versions
  • App Control Server: All Supported Versions
  • Apple macOS: All Supported Versions

Cause

Apple macOS machines have three different types of hostname:

  • Computer Name: User-friendly hostname for the system (as seen in Finder), example: L1234
  • Local Hostname: The local (Bonjour) hostname, example: L1234.local
  • Primary Hostname: The fully qualified hostname (ComputerName + LocalHostName), example: L1234.domain.com

If the endpoint is configured to use a Dynamic Global Hostname a change in network connection could also alter the Primary Hostname and/or the Local Hostname of the machine.

Depending on the combination of changes, at the same time, this could trigger the Agent to re-register and show as a duplicate.

Resolution

Configure the macOS to use the same hostname regardless of network connection:

  1. Verify Dynamic Global Hostname has been disabled on the endpoint(s).
  2. Use Terminal to issue the following command to verify the Computer Name and Primary Hostname:
    sudo scutil --get ComputerName
    sudo scutil --get HostName
  3. Use Terminal to manually set the Primary Hostname to match the Computer Name
    sudo scutil --set HostName <new hostname>
    • If desired/necessary, the following command can be used to set the Computer Name:
      sudo scutil --set ComputerName <new hostname>
    • If desired/necessary, the following command can be used to set the Bonjour Hostname:
      sudo scutil --set LocalHostName <new hostname>
  4. Flush the DNS cache:
    sudo dscacheutil -flushcache
  5. Restart the endpoint.

Additional Information

  • Typically this issue is more common on Intel based macOS machines when the Computer Name has not been set.
  • The Agent relies on system APIs to determine the hostname.
  • Engineering investigated this issue (EA-22001) and found no changes available in the Agent to circumvent this situation.