Troubleshooting

This article covers common issues you may encounter and shows how to diagnose and resolve them.

Audit snapshots overwrite each other

Unique BIOS UUID requirements for virtual machines

For audit tools to work correctly, each virtual machine (VM) in your infrastructure must have a unique BIOS UUID (also called SMBIOS UUID). AlloyScan uses this identifier to register audit agents and audit services and to distinguish one machine from another.

If multiple machines share the same BIOS UUID, agents or services may fail to register, or audit data may be associated with the wrong machine.

Cloning or copying virtual machines can unintentionally duplicate BIOS UUIDs. The following guidelines explain how to ensure that newly created virtual machines receive unique identifiers in common virtualization environments.

Microsoft Hyper-V

In Hyper-V, copying or importing an existing virtual machine is not sufficient. Even if you select Copy the virtual machine (create a new unique ID), Hyper-V only generates a new VM GUID; the BIOS UUID inside the guest operating system remains unchanged.

To guarantee uniqueness, each machine must be created as a new virtual machine object. When a new VM is created, Hyper-V automatically generates a new BIOS UUID. You can then attach a prepared VHDX file or a differencing disk to that VM.

VMware

When starting a copied virtual machine, VMware asks whether the VM was moved or copied. Always choose I copied it. In this case, VMware generates a new UUID and MAC address. If I moved it is selected, the original identifiers are preserved, which can lead to conflicts in the audit system.

Oracle VirtualBox

Use the Clone function and create a Full Clone with the option Generate new MAC addresses enabled. This results in a new virtual machine with updated hardware identifiers, including a new BIOS UUID.

Checking the BIOS UUID

If you are unsure whether machines have unique BIOS UUIDs, you can verify the current value using the operating system.

On Windows, open PowerShell as Administrator and run:

Get-WmiObject Win32_ComputerSystemProduct | Select-Object -Property UUID

On Linux, run as root:

sudo cat /sys/class/dmi/id/product_uuid

If the dmidecode utility is available, you can also use:

sudo dmidecode -s system-uuid