ITOM Help !! ( Discovery Simulation Help)

[SandeepKSingh]

Hi EveryOne,

SCENARIO: Classifying and Discovering the iTunes Application on Windows Server

Background:
Cloud Dimensions is actively working to enhance visibility into the applications running across its data center. With a wide range of software deployed on Windows systems, the IT team needs a robust method to classify and track applications and their dependencies. The goal is to identify what applications are running, understand their relationships with the underlying hardware, and enable proper support and governance.

Use Case:
The first application Cloud Dimensions has chosen to classify is iTunes, which is installed on several Windows servers. Since iTunes can sometimes install background services such as "Helper" processes that the team does not want to include in the classification, a precise filter needs to be used.

Objective:
As the Discovery Administrator, you are responsible for:

1. Creating a process classifier for the iTunes application.

2. Running a targeted discovery on the host with IP 198.51.12.11.

3. Verifying that the iTunes application is identified and that a Runs on::Runs relationship is created between iTunes and the Windows Server.

[Shashank_Jain · Accepted solution]

@SandeepKSingh , 

Please go through the below steps -

1. Create the Process Classifier

1. Navigate to Discovery > CI Classification > Process Classifiers.

2. Click New → fill in the details:

   • Name: iTunes

   • Application: iTunes (create if not exists)

   • Process Name: iTunes.exe (this is the main executable).

   • Active: true.

   • Classification Condition: You can add filters if needed (for example, exclude background services like iTunesHelper.exe).

   • Save the classifier.

 This ensures only the main iTunes process is classified, not its helper services.

2. Run Targeted Discovery

1. Go to Discovery > Discovery Schedules.

2. Click Discover Now (or create a new schedule).

3. Enter the IP address: 198.51.12.11.

4. Run the discovery.

3. Verify the Results

1. Navigate to Discovery Status > Devices → open the discovered server (198.51.12.11).

2. In the related lists, check Processes → confirm iTunes.exe is discovered.

3. Verify that the classifier created the Application CI: iTunes.

4. In the relationships tab, confirm that:

   • iTunes [Runs on::Runs] Windows Server relationship exists.

Hope it helps!

[Ravi Gaurav · Accepted solution]

Hi @SandeepKSingh 

This question is from CIS-DISCOVERY Simulation:-

You can follow the below :-

1. Create a Process Classifier for iTunes

Since you want to identify iTunes specifically and avoid background "Helper" processes, you’ll create a Process Classifier:Navigate to: Discovery > CI Classification > Process Classifiers.

Click New.

1. Fill in details:
2. Name: iTunes
3. Application: iTunes (create an Application CI type if not already present under cmdb_ci_app or custom application class).
4. Executable Name: iTunes.exe (case-sensitive, so be exact).
5. Command Line Contains (optional filter): Add additional keywords if needed.
6. Exclude: Create exclusion rules for unwanted processes (like "iTunesHelper.exe" or "AppleMobileDeviceService.exe").
7. Save the classifier.
8. This ensures that only the main iTunes process is classified as the application, not the helper services.

2. Run Targeted Discovery on Host

You want to run discovery on a specific IP: 198.51.12.11.

Go to: Discovery > Discovery Schedules.

Create a new schedule:

1. Name: Targeted Discovery – iTunes Test

2. Discovery Type: Horizontal Discovery

3. MID Server: Select the right MID Server for the network range.

4. IP Ranges: Enter 198.51.12.11.

5. Shazzam Port Scan: Enabled (to identify listening ports).

6. Click Execute Now.

This will run discovery only on that host.

 

3. Verify iTunes Application Identification

After discovery completes:

1. Navigate to: Discovery > Status > Discovery Status.
2. Check the log for the job you just ran.
3. Go to the CI record:
4. Application CI: Search for iTunes in the cmdb_ci_appl or your application class.
5. Validate:
6. The iTunes CI is created.
7. A Runs on::Runs relationship exists between:
8. iTunes (application)
9. Windows Server (host CI: cmdb_ci_win_server).

[Shashank_Jain · Accepted solution]

@SandeepKSingh , 

Please go through the below steps -

1. Create the Process Classifier

1. Navigate to Discovery > CI Classification > Process Classifiers.

2. Click New → fill in the details:

   • Name: iTunes

   • Application: iTunes (create if not exists)

   • Process Name: iTunes.exe (this is the main executable).

   • Active: true.

   • Classification Condition: You can add filters if needed (for example, exclude background services like iTunesHelper.exe).

   • Save the classifier.

 This ensures only the main iTunes process is classified, not its helper services.

2. Run Targeted Discovery

1. Go to Discovery > Discovery Schedules.

2. Click Discover Now (or create a new schedule).

3. Enter the IP address: 198.51.12.11.

4. Run the discovery.

3. Verify the Results

1. Navigate to Discovery Status > Devices → open the discovered server (198.51.12.11).

2. In the related lists, check Processes → confirm iTunes.exe is discovered.

3. Verify that the classifier created the Application CI: iTunes.

4. In the relationships tab, confirm that:

   • iTunes [Runs on::Runs] Windows Server relationship exists.

Hope it helps!

[Ravi Gaurav · Accepted solution]

Hi @SandeepKSingh 

This question is from CIS-DISCOVERY Simulation:-

You can follow the below :-

1. Create a Process Classifier for iTunes

Since you want to identify iTunes specifically and avoid background "Helper" processes, you’ll create a Process Classifier:Navigate to: Discovery > CI Classification > Process Classifiers.

Click New.

1. Fill in details:
2. Name: iTunes
3. Application: iTunes (create an Application CI type if not already present under cmdb_ci_app or custom application class).
4. Executable Name: iTunes.exe (case-sensitive, so be exact).
5. Command Line Contains (optional filter): Add additional keywords if needed.
6. Exclude: Create exclusion rules for unwanted processes (like "iTunesHelper.exe" or "AppleMobileDeviceService.exe").
7. Save the classifier.
8. This ensures that only the main iTunes process is classified as the application, not the helper services.

2. Run Targeted Discovery on Host

You want to run discovery on a specific IP: 198.51.12.11.

Go to: Discovery > Discovery Schedules.

Create a new schedule:

1. Name: Targeted Discovery – iTunes Test

2. Discovery Type: Horizontal Discovery

3. MID Server: Select the right MID Server for the network range.

4. IP Ranges: Enter 198.51.12.11.

5. Shazzam Port Scan: Enabled (to identify listening ports).

6. Click Execute Now.

This will run discovery only on that host.

 

3. Verify iTunes Application Identification

After discovery completes:

1. Navigate to: Discovery > Status > Discovery Status.
2. Check the log for the job you just ran.
3. Go to the CI record:
4. Application CI: Search for iTunes in the cmdb_ci_appl or your application class.
5. Validate:
6. The iTunes CI is created.
7. A Runs on::Runs relationship exists between:
8. iTunes (application)
9. Windows Server (host CI: cmdb_ci_win_server).

[Bhuvan]

@SandeepKSingh 

Refer below post that explains in detail every step along with screenshots,

https://www.servicenow.com/community/itom-forum/classify-and-discover-itunes-running-on-a-window-ser...

If this helped to answer your query, please mark it helpful & accept the solution.

Thanks,

Bhuvan

[Bhuvan · Accepted solution]

@SandeepKSingh 

You can also use below knowledge article for reference,

https://learning.servicenow.com/lxp/en/on-demand-training-and-content/how-to-classify-and-discover-i...

Solution:

How to Classify and Discover iTunes Running on a Windows Server

Ensure you have created an 'iTunes' process classification record in the discovery_classy_proc table in your instance and filled in the specific details on how to spot it in the Condition field and what type of record to create once found etc.

Navigate to CI Classification —> Processes > Create a new Process classification called iTunes
Relationship type should be Runs on::Runs and
Condition = Command | contains | iTunes.exe

Once you have created that process classification record, you then need to run Discovery against your MID Server by going to Discovery Schedules - Quick Discovery and entering your MID IP Address and selecting your MID Server in the reference field.

Once the discovery is complete there should be a iTunes application created in the related list on the Process Classifier record that is linked to your MID Server CI Record.

If this helped to answer your query, please mark it helpful & accept the solution.

Thanks,

Bhuvan