OCS Inventory NG

Videos

Overview: OCS Inventory NG 2.12 on Ubuntu 24.04 LTS on Azure: overview (watch on YouTube)

Launch and log in: OCS Inventory NG 2.12 on Ubuntu 24.04 LTS on Azure: launch and log in (watch on YouTube)

Deep Dive: OCS Inventory NG 2.12 on Ubuntu 24.04 LTS on Azure: deep dive (watch on YouTube)

Prerequisites

• An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region.
• Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point for a few hundred machines. Move up to Standard_D2s_v3 or larger for a big estate or heavy software deployment use.
• NSG inbound rules: allow 22/tcp from your management network, 80/tcp so both the console and the agent endpoint are reachable, and 443/tcp if you terminate TLS on the VM.
• Your agents must be able to reach port 80 (or 443) on this VM.
• The bundled MariaDB is never exposed. It listens on 127.0.0.1 only, so port 3306 stays off the network.

Launch from the Azure Marketplace

In the Azure portal, choose Create a resource, search for the SecureAnyCloud OCS Inventory NG offering, and select it. Pick your subscription, resource group and region, choose Standard_B2s or larger, and select SSH public key authentication with the user name azureuser.

On the Disks blade, leave the attached data disk in place, because it carries your inventory database and deployment packages. On the Networking blade, attach an NSG that allows 22, 80 and 443 inbound. Then select Review + create.

Launch from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:ocs-inventory-ng:default:latest
az vm create \
  --resource-group my-resource-group \
  --name ocs-inventory \
  --image sac1647283583153:ocs-inventory-ng:default:latest sac OCS Inventory NG offer URN> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group my-resource-group --name ocs-inventory --port 80 --priority 1001

First boot

On the first boot of your VM, a one-shot service, ocs-inventory-ng-firstboot.service, generates a console administrator password and a database password unique to that instance. It writes them into the console and communication server configuration in lock step, restarts Apache so that the communication server picks up the new database secret, and records everything in a root-only file. The service runs once and does nothing on subsequent boots.

Connect over SSH and confirm that the stack is up:

systemctl is-active apache2 mariadb
systemctl is-enabled ocs-inventory-ng-software-aggregate.timer curl -s -o /dev/null -w 'healthz: %{http_code}\n' http://127.0.0.1/healthz curl -s -o /dev/null -w 'console: %{http_code}\n' -L http://127.0.0.1/ocsreports/

Retrieve your console password

The per-VM credentials are written to a root-only file. Display it:

sudo cat /root/ocs-inventory-ng-credentials.txt

The file records the console URL, the console user (admin) and its per-VM password, the agent server URL you will point your agents at, and the loopback MariaDB details.

The addresses in that file are this VM's own address as seen from inside the VM. Azure does not expose the public IP to the instance, so the address is usually the private one. Browsing the public IP shown in the Azure portal works identically. OCS builds its console links relative to the request, so it answers correctly on the public IP, the private IP or any DNS name you point at it.

Sign in to the console

Browse to http://<your-vm-address>/ocsreports/ (the bare address redirects there). Sign in as admin with the password from the credentials file.

The dashboard summarizes the estate this server is tracking: how many machines have reported, how they split across Windows, Unix and Android, and which agent and operating system versions are in use.

Enroll your first agent

A fresh server has an empty estate. Machines appear as soon as an agent reports to it. Take the agent server URL from your credentials file (http://<your-vm-address>/ocsinventory) and point agents at it.

On a Debian or Ubuntu machine that you want to inventory, run:

sudo apt-get install -y ocsinventory-agent
sudo tee /etc/ocsinventory/ocsinventory-agent.cfg >/dev/null <<'EOF' server = http://<your-vm-address>/ocsinventory tag = london-office EOF
sudo ocsinventory-agent --force

The tag is free text that groups machines in the console, so set something meaningful per site or department at enrollment time. On Red Hat family machines, the package is ocsinventory-agent from EPEL. For Windows and macOS, download the agent installer from the OCS Inventory NG project's own download page and give it the same server URL.

Within seconds of the agent running, the machine appears in All computers with its operating system, memory and processor:

Select a machine to open its full inventory: detected operating system, memory, network address, the reporting agent version and the timestamp of the last inventory, with tabs for hardware, software, network, devices and deployment.

You can confirm the same result from the shell, which is useful when checking whether a remote agent really reached the server:

curl -s -o /dev/null -w 'agent endpoint: %{http_code}\n' http://127.0.0.1/ocsinventory
sudo mariadb --protocol=socket -uroot ocsweb -e "SELECT NAME, OSNAME, MEMORY, LASTDATE FROM hardware ORDER BY LASTDATE DESC LIMIT 10;"

A GET on the agent endpoint returning 400 is correct and healthy. Agents POST compressed XML there, so a plain browser request is rejected by design.

How software inventory is indexed

The communication server records every package an agent reports, but the console's All software view reads through a separate index. This image ships ocs-inventory-ng-software-aggregate.timer, which runs the project's own aggregation job every 30 minutes to rebuild that index, so newly reported software appears without any action from you. To rebuild the index immediately after enrolling a batch of machines, run:

sudo systemctl start ocs-inventory-ng-software-aggregate.service
sudo mariadb --protocol=socket -uroot ocsweb -e "SELECT COUNT(*) AS indexed_software FROM software_link;"

To change the cadence, edit /etc/systemd/system/ocs-inventory-ng-software-aggregate.timer and run sudo systemctl daemon-reload.

The project also ships optional maintenance jobs in /usr/share/ocsinventory-reports/ocsreports/crontab/ for CVE import, orphan cleanup, IpDiscover, wake-on-LAN and notifications. They are present but not scheduled, so you can enable only the ones you want.

Security model

There is no shipped default login. Upstream's installer leaves two well-known credentials behind, and this image removes both:

• The console's seeded admin account, whose password is the published default, is rotated to a value nobody has, and then to a fresh per-VM password on first boot.
• The database login that upstream's web installer hardcodes is rotated per VM, and the wildcard-host database account it creates (reachable from any address the database listens on) is removed entirely.

The install and update wizards are denied from the web and readable only by root, which also clears the security banner that OCS otherwise displays on every page. You can verify the whole posture on your own VM:

sudo bash /usr/local/sbin/ocs-inventory-ng-cred-roundtrip.sh curl -s -o /dev/null -w 'install wizard: %{http_code}\n' http://127.0.0.1/ocsreports/install.php
sudo mariadb --protocol=socket -uroot -N -B -e "SELECT COUNT(*) AS wildcard_accounts FROM mysql.user WHERE User='ocs' AND Host='%';"

The round-trip check signs in through the real console login form with your per-VM password, then confirms that a blank password and the published defaults are all rejected.

Where your data lives

A dedicated Azure data disk is mounted at /data and carries both halves of your data, so none of your data sits on the OS disk:

findmnt -no SOURCE,TARGET,FSTYPE /data /var/lib/mysql /var/lib/ocsinventory-reports df -h /data

/var/lib/mysql holds the ocsweb inventory database and /var/lib/ocsinventory-reports holds the deployment packages, SNMP data, IpDiscover results and console logs. Both are bind-mounted from the data disk, so you can grow the disk in Azure and both follow.

To back up the inventory database, run:

sudo mariadb-dump --protocol=socket -uroot --single-transaction ocsweb | gzip > /tmp/ocsweb-backup.sql.gz ls -lh /tmp/ocsweb-backup.sql.gz

Enabling HTTPS

Agents and the console both use port 80 by default. To terminate TLS on the VM, point a DNS name at the public IP, open 443, and use the packaged Certbot Apache plugin:

sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d ocs.your-domain.example --agree-tos -m admin@your-domain.example --redirect

After the certificate is issued, update your agents' server setting to the https:// URL. The console follows the request scheme automatically, so its links switch to HTTPS without further configuration.

Optional: the REST API

The project's REST API is installed, and its Apache configuration is present at /etc/apache2/conf-available/zz-ocsinventory-restapi.conf. It is not enabled, because upstream restricts it to 127.0.0.1, so it offers nothing over the network as shipped. To turn it on, enable the configuration and reload Apache. Then adjust the Require ip directive to match the clients you want to allow.

Service operations

systemctl status apache2 --no-pager | head -5
systemctl status mariadb --no-pager | head -5
systemctl list-timers ocs-inventory-ng-software-aggregate.timer --no-pager sudo tail -5 /var/log/apache2/ocsinventory-error.log

The communication server logs to /var/log/ocsinventory-server/. When an agent is not appearing, first raise LOGLEVEL to 1 in the console's Configuration menu to make the logs considerably more detailed.

Troubleshooting

An agent runs but the machine never appears. Confirm that the agent can reach this VM on port 80 and that your NSG allows it. Then check that the agent is really posting rather than falling back to writing a local file: sudo ocsinventory-agent --force prints the server response. On the server, sudo tail /var/log/apache2/ocsinventory-error.log shows rejected inventories.

The console loads but shows no software. The software index is rebuilt every 30 minutes. Run sudo systemctl start ocs-inventory-ng-software-aggregate.service to rebuild it immediately.

You forgot the console password. It is in /root/ocs-inventory-ng-credentials.txt. If the password was changed inside the console and then lost, reset it in the database and sign in with the new value:

sudo mariadb --protocol=socket -uroot ocsweb -e "UPDATE operators SET PASSWD=SHA2('<new-password>',256), PASSWORD_VERSION=2 WHERE ID='admin';"

Support

SecureAnyCloud provides 24/7 technical support for this product by email (sales@secureanycloud.com) and live chat, covering deployment, agent enrollment across Windows, Linux and macOS, console and permissions configuration, IpDiscover and SNMP setup, software deployment packages, upgrades, performance tuning and MariaDB administration. Critical issues receive a one-hour average response time.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch OCS Inventory NG 2.12 IT Asset Management on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com