Preventing Discovery Data Source from updating "Most Recent Discovery" field

bwest219
Tera Contributor

Hi All - I've been asked to modify a couple of individual data sources in Discovery to not update the "Most Recent Discovery" field on CI's. My client wants this field to represent the last full scan done, not just a probe. I found some docs saying there's a property (flag) called "skip_updating_last_scan_to_now" I can put on the data source's Robust transformer to tell it to skip updating that field (1st screenshot below).  I tried this on a data source (2nd screenshot) and it doesn't seem to be acknowledging that property and it updates the field in the CMDB either way.  Anyone know what's going on here? or maybe any other ideas how I can tell particular data sources not to update the "Most Recent Discovery" field?

 

bwest219_0-1668032918666.png

 

bwest219_1-1668033057044.png

 

2 REPLIES 2

cyked
Mega Guru

Started looking into this and additional functionality from IRE and came across your post.  A couple of things based on below.  I believe the custom property for a Robust Import Set Transformer where you set Properties like in your second screenshot, is actually ire.skip_updating_last_scan_to_now.  Also this property per docs won't help you with most recent discovery field (last_discovered) or discovery_source.

 

In docs the only thing I see that supports the idea of preventing something going through IRE from updating most recent discovery is "glide.identification_engine.skip_updating_source_last_discovered_if_older".  Everything else I've found calls outlast_scan field on the sys_object_source table. 

 

 

So I think this is the one you want

glide.identification_engine.skip_updating_source_last_discovered_if_older
Determines how IRE updates the last_discovered and the discovery_source attributes in the CMDB.

 

 

 

 

TRUE: If last_discovered is provided in the payload and it is older than the last_discovered of the CI in the CMDB, IRE does not use the payload values to update the last_discovered and the discovery_source attributes in the CMDB.
FALSE: Even if the last_discovered provided in the payload is older than the last_discovered of the CI in the CMDB, IRE uses the payload values to update the last_discovered and the discovery_source attributes in the CMDB.

 

 

 

This is great, but it doesn't sound like it guarantees that your other sources WON'T set last_discovered because a source might have scanned data that is more current than say discovery, depending on how often you are running discovery.

 

 

Maybe related:

I also see glide.identification_engine.batch_update_last_discovered, which says:

Controls batch update of last_discovered field in CIs that are being processed by the identification engine.

Set to false if there are business rules that apply to the last_discovered field, and you want to trigger these rules when calling an Identification and Reconciliation API.

 

Honestly I don't know what this is trying to convey.  If you have BRs that will set last_discovered, set this property to false so IRE doesn't also try to set it in batches? What if you set it to true?  I assume it doesn't prevent BRs from running, so does it allow the BR to set last_discovered AND IRE batch updates will as well?

 

 

EDIT:  also check out glide.identification_engine.ire_message_listener_skip_updating_source_last_discovered_to_now

toddjarman
Tera Expert

I have a situation where I'm trying to run a business rule everytime a CI is updated and it wasn't working.  I added this property glide.identification_engine.batch_update_last_discovered and set the value to false.  And now discovery is triggering the business rule as I want.  So without that property, or with the property set to true, my Busines Rule does not run on discovery updates.  My question is, what else could having the property set to false impact?