Open-AudIT Network Discovery: First Scan to Inventory Report

This guide is for a sysadmin or MSP technician who has just installed Open-AudIT and wants a usable inventory instead of a list of IP addresses. The short answer: add working credentials first, discover one /24 subnet at a time, check the discovery log for devices that only Nmap could see, fix access and run again, then answer your questions with the built-in queries and export the results as CSV or JSON. Discovery is agentless: Open-AudIT finds hosts with Nmap and then audits them over WMI, SSH and SNMP.

The steps, menu names and settings below come from FirstWave’s official Open-AudIT documentation, pricing and download pages, checked on 30 October 2026, and from our Open-AudIT program page. Not tested yet: we have not run these steps on our own network, so treat this as a documentation-based walkthrough and try it on a small subnet first.

Before you start

After the first login you are asked to activate the free licence: click Activate, choose your country and accept the EULA. If you closed that screen, go to Menu → Admin → Licenses and use Enter a License Key. The Windows install page also warns that the installer sets a default root password; change it before the server holds real data.

Step 1: Add credentials

Discovery without credentials gives you little more than an IP address, a MAC address and a guess at the device type. Add credentials before the first scan.

1. Open Menu → Discover → Credentials → Create Credentials.
2. Enter a Name, pick the Organization and choose the Type: SNMP v1/v2, SNMP v3, SSH, SSH Key or Windows (WMI).
3. Fill in the type-specific fields and click Submit. For SSH keys, paste the full private key including the BEGIN and END lines.
4. Repeat for each set you need: a Windows audit account, a Linux account with sudo, and the SNMP communities or v3 users your switches, printers and UPS units use.

If you have many sets, Import Multiple Credentials on the same menu accepts a CSV file. Open-AudIT tries device-specific credentials first, then the rest, starting with the ones that worked before, and uses the first set that succeeds for the full audit.

Two caveats from the documentation: SSH key authentication is not supported when the Open-AudIT server itself runs on Windows, and credentials are stored encrypted but appear decrypted in CSV, XML and JSON exports unless you set decrypt_credentials to n in the configuration.

Step 2: Create and run the first discovery

1. Open Menu → Discover → Discoveries → Create Discoveries.
2. Give it a Name such as HQ servers VLAN and a Network Address. Accepted formats are a subnet (192.168.1.0/24), a range (192.168.1-10.1-254) or a single IP (192.168.1.200).
3. Click Submit to open the discovery details page.
4. Click Execute (the play icon in the toolbar). The job runs in the background and the log panel refreshes every 20 seconds.

Behind the scenes Open-AudIT runs an Nmap ping sweep, queues the live addresses and processes them with up to 20 parallel workers (the discovery_limit setting). Each host gets a port scan of the top 1,000 TCP ports plus UDP 161 and 62078. An open port 22 leads to an SSH audit, 135 to a WMI audit and UDP 161 to SNMP queries. Since version 6.0.0 the Windows audit is PowerShell-based and the old VBScript audit is deprecated.

FirstWave recommends one /24 per discovery; a /16 can take hours.

Other discovery types

The Advanced button on the discovery form exposes the discovery type. Subnet is the default and scans every address you gave. Active Directory asks the domain for its computer accounts, so you need the AD domain and an account allowed to query it. Seed starts from a few known devices and follows their SNMP neighbour, ARP and routing tables to find more of the network. Customisable scan options per discovery and credential priority are listed for the Enterprise edition, so in the free edition expect the defaults.

Step 3: Find the blind spots

The first pass always leaves some devices half-audited. Open a device and look at Last Seen By in its details. If it says NMAP, Open-AudIT saw the host but no credential worked or no audit completed. SNMP, SSH or Audit means authentication succeeded.

1. Open the device’s Discovery Log from the left sidebar of the device page and read where it stopped.
2. Check reachability from the Open-AudIT server with nmap -F <ip>, or nmap -sU -p 161 <ip> for SNMP-only devices.
3. For Windows, allow remote WMI through the firewall (the docs call this out for Server Core) and use an account with Administrator rights. A Linux-hosted server auditing Windows also needs TCP 445 open and the target must allow remote script execution.
4. For Linux, use root or a sudo-enabled account. Where sudo without a terminal is blocked, the documentation says you need root credentials.
5. If the log is not detailed enough, raise log_level from the default 5 to 7 under Menu → Admin → Configuration and run the discovery again.

Repeat until the remaining NMAP-only devices are ones you expect, such as unmanaged switches or phones without SNMP.

Step 4: Turn the data into reports

Everything lives under the Report menu. Queries run SQL against the device database and return a list; Summaries group and count devices, and clicking a row drills down.

• Narrow a result with URL filters such as &system.manufacturer=Dell or &limit=50.
• Add &format=json to get the same result as JSON, or export it as CSV or XML for a spreadsheet or a licence review.
• To build your own, open Menu → Manage → Queries → Create Queries, set the Name, the Menu Category it should appear under and Menu Display, then write the SQL. The WHERE clause must include @filter so results respect the user’s organisation.
• Run the same discovery again later; configuration change detection shows added or removed software and hardware between audits.

If the inventory should feed a help desk and asset lifecycle, GLPI is the usual next step; see our GLPI page and the IT asset management and help desk hub.

Free edition vs paid editions

Limitations

• Without scheduling in the free edition, you run discoveries by hand with Execute; set a calendar reminder if you want monthly audits.
• FirstWave’s own pages disagree on the free device count: the licence activation guide describes a free licence for up to 100 devices, while the pricing page lists the Free column with unlimited devices. Check the current wording before you plan a larger rollout.
• The quality of the inventory depends entirely on credentials and firewall rules; expect several passes on a network you inherited.
• Open-AudIT is an inventory and audit tool, not a topology mapper or a fast port scanner. For physical switch-port maps use LanTopoLog, and for a quick list of live hosts SoftPerfect Network Scanner or Angry IP Scanner are lighter.

FAQ

What is Open-AudIT Community edition?

Community is the older name for the free, open source version, and FirstWave’s features table still uses it. Current documentation calls it the Free edition, activated with a free licence inside the product.

Does Open-AudIT run in Docker?

FirstWave’s supported options are the Linux installer, the Windows Server installer and a virtual appliance that bundles Open-AudIT with NMIS. Community Docker images exist, but they are not official.

Is Open-AudIT on GitHub?

Yes, the source is published by Opmantek (now FirstWave) under AGPL-3.0. GitHub releases lag behind the official download page, so take installers from open-audit.com.

How many devices can the free edition discover?

The licence activation guide says the free licence covers up to 100 devices, while the pricing page lists unlimited devices for Free. Confirm with FirstWave if your network is larger than 100 devices.

Can I schedule discoveries in the free edition?

No. Scheduled discovery and reporting are listed for Professional and Enterprise. In the free edition you open the discovery and click Execute.

Why does a device show only NMAP as Last Seen By?

Open-AudIT found the host but could not log in or finish the audit. Check the device’s Discovery Log, the firewall ports for WMI, SSH or SNMP, and the account rights, then run the discovery again.

Last updated: 30 October 2026 · AdminHub Plus editorial team. Licence, version and platform details are checked against each developer's official documentation.