This log message is a bit incorrect:
info: Copied file '/var/cfengine/cdphp/app_carbon_black/templates/windows/Windows_sensorsettings.ini' from 'C:\Windows\temp\app_carbon_black\sensorsettings.ini.cfnew' to '10.240.24.9'
I think it would be more correct as:
info: Copied file '/var/cfengine/cdphp/app_carbon_black/templates/windows/Windows_sensorsettings.ini' from '10.240.24.9' to 'C:\Windows\temp\app_carbon_black\sensorsettings.ini.cfnew'
A subsequent info message indicates:
info: Moved 'C:/Windows/Temp\ENT_8549_windows_secure_cp\sensor_settings.ini.cfnew' to 'C:/Windows/Temp\ENT_8549_windows_secure_cp\sensor_settings.ini'
Typically I would just open a PR myself to make this kind of minor change, but I don't understand how the IP is the last expansion:
RecordChange(ctx, pp, attr, "Copied file '%s' from '%s' to '%s'",
source, conn->remoteip, new);
*result = PromiseResultUpdate(*result, PROMISE_RESULT_CHANGE);
As I read that source IP would be in the second field.
Oh, wait, I am reading master source, looking at the history there I find my answer in https://github.com/cfengine/core/commit/94d1d3b778af5243bc1c4048077b0ae4ed50fd7e where Vratislav Podzimek already fixed this and cherry picked it back to 3.18.x https://github.com/cfengine/core/commit/a4fba9d370ab6a2805ff790e163facd7bb8d143b
So, opening and closing this for posterity since I don't see a ticket in the commit message.