ServiceNow - Discovery
Discovery finds computers, servers, printers, a variety of
IP-enabled devices, and the applications that run on them.
It can then update the CIs in your CMDB with the data it
collects. Plugin : sn_itom_pattern
There are two types of discovery:
Horizontal discovery
Top-down discovery
Folllow on
Horizontal discovery is a technique Discovery uses to scan your network, find
computers and devices, and then populate the CMDB with the CIs it finds.
Horizontal discovery creates direct relationships between CIs, such as a runs-
on relationship between an application CI and the actual computer CI it runs
on.
Horizontal discovery is not aware of business services and does not create
relationships between CIs based on the business service they are in.
In TopDown discovery/ServiceMapping we provide entry point (URL) then
Discovery checks it and build the business service from its CIs and
connections to it. Service Mapping uses results of horizontal discovery
performed by Discovery.
Folllow on
ServiceNow - Discovery
10.0.0.4 10.0.0.5 10.0.0.6
Application Entry
Point
http://10.0.0.4:8080
/myapp
Tomcat mySql
Windows Server
Horizontal Discovery Top Down Discovery
Folllow on
128 bit TLS
protocol
ServiceNow ECC Queue
Firewall Mid Server
AWS
Azure
Internal Network
Public Cloud Folllow on
Discovery Components
Discovery uses these components to find CIs:
Probes and Sensors - Written in JavaScript. In
Discovery the job of Probe is to collect the information
and then Sensor processes that information to update
the CMDB. Both get their instructions from the ECC
queue.
Patterns - Written in Neebula Discovery Language
(NDL). A Pattern is a series of operations that collect
data, process it, and update the CMDB. A pattern
performs the same function as a probe.
Folllow on
Probes Patterns
Runs during the identification and exploration
Runs during all discovery phases.
phases only.
Supports all standard network and ci
discovery.
Supports all standard network, and CI discovery. Supports Cloud discovery, configuration file
tracking
Creating or customizing a probe requires Pattern designer is a user friendly interface to
knowledge of JAVA, JAVA script create or customize a pattern
In identification or exploration phase, Probe can Pattern has faster performance as all the
take longer time for discovery because of operations needed to execute are inside the
sending multiple probes. pattern only.
Folllow on
Horizontal discovery phases
Discovery uses these components to find CIs:
Scanning - Sends Shazzam probe to check open
ports in network (eg: 135 for windows server)
Classification - Checks for type of device or OS on
device
Identification - Create or update CI in CMDB, Use
IRE rules
Exploration - Gather additional information on
devices ie : applications, memory etc and create
relationship
Folllow on
Start Discovery Scanning
Shazzam Prob scan for active
port in device IP 10.0.0.6
IP - 10.0.0.6
Port 135 is active (Windows
Classification
Device), Sends probe “Windows -
Classify”
Identification
Execute Patterns “Windows OS -
Servers” for Identification and
Exploration
End Discovery Exploration
Folllow on
Discovery - Credentials
Mid Server uses credentials configured in
discovery_credentials table to access resources for
Discovery and Service Mapping.
Create and Test Credential
Navigate to Discovery > Credentials
Click New
Click a link for the credential type and complete the
form.
Under Related Links, click Test credential.
Folllow on
Discovery - Status
The Discovery status provides a summary of a Discovery launched.
Navigate to Discovery > Status and open the status record for a Discovery
Discovery status displays high level information such as the date of the
Discovery, the mode, the number of probe messages sent to devices, and the
number of sensor records that were processed.
Helps in troubleshoot a failed discovery.
You can manually cancel a discovery while it is in progress from the Discovery
Status record.
A Discovery timeline generates a graphical display of a Discovery Status
record
The Devices related list in the Discovery Status form provides a summary list
of all the devices scanned.
Folllow on
Discovery - ECC Queue
External Communication Channel
Connection point between an instance and MID
Server.
MID Server Contains records that are created during all stages
of discovery.
Output queue indicates message from instance to
MID server.
ECC Queue Input queue indicates message from MID server to
Instance.
OUTPUT INPUT Provides actual XML payload that is sent to or from
an instance.
SNOW By Default records in the ECC Queue older than 7
days are deleted automatically.
Folllow on
Discovery - ECC Queue
External Communication Channel
ECC queue States
When new probe instructions are available for the MID Server, the system
creates an output record with the state of ready.
The MID Server then starts processing the probe instructions and the state
changes to processing before it finally changes to processed.
When a result returns to the MID Server and is ready to be sent to the
instance, the system creates an input record with the state of ready.
While the system processes the payload, the state changes to processing
before it finally changes to processed.
If any errors are encountered, the state changes to error. You can look for
errors to troubleshoot failed discovery.
Folllow on
Discovery - Schedule
What to discover, when to discover, who(MID Server) will discover.
Run Discovery on a single IP address.
Run a Discovery schedule manually.
Configure the use of multiple MID Servers for load balancing.
Configure the use of multiple Shazzam probes for load balancing.
Create or disable a schedule that controls when the Discovery runs in your
network.
Quick Discovery - Allows an administrator to run a CI Configuration discovery
on a single IP address without requiring a schedule.
Folllow on
Discovery - Schedule Form
Name - Unique Name for schedule.
Discover - Discovery Scan types
Configuration items - Uses Discovery identifiers to match devices with CIs
in the CMDB and update the CMDB.
IP addresses - Discover all the active IP addresses in the specified range and
create device history records, but do not update the CMDB.
Networks - Discovers IP networks (routers and switches).
Service - Discovers services for the Service Mapping application.
Serverless - Finds CIs without needing to run discovery on a host.
Cloud application - Discovers only the cloud resources for the patterns that
you specify.
Cloud resources - Discovers resources for one of the supported cloud
providers.
Folllow on
Discovery - Schedule Form
MID Server selection method
Auto-Select MID Server - Select the MID Server automatically based on the
Discovery IP Ranges you configure.
Specific MID Cluster - Use a preconfigured cluster of MID Servers.
Specific MID Server - Use only one MID Server.
Use Behavior - Servers to perform load balancing, scanning multiple
domain, scan multiple windows credentials, execute multiple
protocols(SNMP, WMI or SSH) using more than one MID server.
MID Server - Selection for MID Server.
MID Server Cluster - Selection for MID Server Cluster.
Behavior - Selection for Behavior.
Location - Location to assign to the CIs that the schedule discovers.
Max run time - Set a time limit for running this schedule.
Folllow on
Discovery - Schedule Form
Run - Set schedule time for Discovery to run.
Log state changes - Check box to create a log entry every time the state
changes during a discovery, such as a device going from Active to Classifying.
Location - Location to assign to the CIs that the schedule discovers.
Max run time - Set a time limit for running this schedule.
Shazzam batch size - Set the number of IP addresses that each Shazzam probe
can scan.
Shazzam cluster support - Check box for distributing Shazzam processing
among multiple MID Servers in a cluster and improve performance.
Use SNMP Version - Designate the SNMP version to use for this discovery.
Quick ranges - Create IP addresses and address ranges for schedule.
Discover now - Use this link to immediately start this Discovery.
Folllow on
Discovery - Schedule Related List
IP Ranges - Defines the ranges of IP addresses to scan with this schedule.
Discovery Range Sets - Defines each range set in a schedule to scan by one
or more Shazzam probes.
Discovery Status - Displays the results of current and past schedule runs.
Global IP exclude - allows administrators to define global IP exclusions lists
that work across Discovery schedules
Folllow on
