What are these mysterious "messages" that you keep hearing about in Discovery? And what on earth is the "ECC Queue"?
The ECC Queue is simply a database table, nothing more. Discovery uses rows in this table to send messages to MID servers, and to receive messages from them. The notion really isn't any more complicted than that! There are, however, lots of details about exactly how those messages are constructed...
If you click on the thumbnail at right to expand it, you'll see a typical message in the ECC Queue. Here's what all those fields mean:
- Agent: The name of the MID server that this messages is either from or to.
- Topic: The name of the probe the MID server is to run (or ran, if this is a response from a MID server).
- Name: This could be either a descriptive name for human use, or (as in this case) the actual command the probe is to run (or ran). In the case of the SSHCommand probe in this example, this field contains the actual command being run.
- Source: For most probes, this contains the IP address that the probe is to run against (or ran against). A few probes (the Ping probe is a good example) run against multiple IP addresses; in those cases, this field contains a human-readable description.
- Response to: The message that this message is in response to. In our example, this is a response from a SSHCommand message.
- Queue: This is set to "output" if this is a message to a MID server, and to "input" (as in this example) if this is a message from a MID server.
- State: This field is set to "ready" if the message has not yet been processed, to "processed" if the message has been successfully processed, and to "error" if an error occurred while the message was being processed.
- Created: The time when this message was created.
- Processed: The time when this message was processed.
- Sequence: The unique sequence number for this message.
- Error string: An error message if an error occurred during processing (this field is hidden unless there was an error).
- Payload: The body of the message. Messages from MID servers always have the general form seen in the XML popup window in the example. The returned XML document has a root tag of containing one or more tags and a single tag. The parameters are simply an echo of those sent to the MID server in the probe; they vary from probe to probe, but in general they tell the probe the details of what it is to do and how it should behave. The result tags are the most interesting ones: they contain the actual data generated by the probe. In this case, you can see the result of running the cat /proc/meminfo command on a Linux server, exactly as if you had typed the command yourself at the command prompt.
Armed with what you've learned above, you should be able to poke around in your instance's ECC Queue and see the nitty-gritty of what Discovery is doing. It's all right there — there's nothing hidden behind curtains anywhere...
2 Comments
