AWS Discovery : Unable to discover Server CI's

[Keerthy S]

Hi All,

We are migrating from On-Prem to Cloud infrastructure. Need your kind guidance for the below queries. 

1. Currently we are in On-Prem, and we do have our service account configured in each Windows/Linux host machine and we do have credentials for Windows/Linux CIs. When we move to AWS Cloud, Does cloud discovery automatically discovers the Cloud Resource + Server CIs  (or) do we need to inform Cloud Engineering Team to configure the Service account in each host machine[Windows/Linux] as we did in On-Prem method. 
2. What is Best practice to discover the Cloud Server CIs[Window/Linux] ? Can we you please guide me with configuration steps. 
3. Issue facing:
   • We are unable to discovery the Cloud Server CI's [Windows/Linux]. Schedule job is completed successfully with out error. 

Thanks, 

Keerthy.                                              

[Harneet Sital]

Hi @Keerthy S 

If you are able to discover 5% of the servers that means the credentials are able to connect with your project and are able to discover. Ideally, you won't be able to the second screen on your discovery schedule if the credentials are incorrect which shows the data centers, hence that prove that your credentials are able to connect. 

Now to the problem where 95% are missing - are you looking at the VM instances (cmdb_ci_vm_instance) or actual windows servers records (cmdb_ci_win_server)? If VM instances are missing only issue I can think of is the credentials do not have the right permission to discover all the servers, confirm with your AWS team if the service account has all the required API access and to all accounts where these Servers are hosted. If its the windows servers, then you might be missing the local admin credentials to those machines. If you have the credentials, make sure you have created them in the credentials table then only servers will be discovered. 

To answer your queries

1. How to Validate the AWS Credentials? (i.e I'm trying to validating the credentials again)

Answer - If the credentials are incorrect, you will straight away see an error logged on the discovery schedule and the discovery will not execute.

2. For your point 2, the answer is in the error logs itself - ' (ii) Adding target to blacklist, no valid credential found for type[Window] ' this means that the windows credentials you have are not valid to log into the VMs to create the windows server records. 

3. For your point 3, the discovery will run at the scheduled time and if the VM is available at that time it will be picked up and created in ServiceNow as a CI. Now you need to make sure to discover the Windows server you already have/create local admin credentials which are the same as you have in your credentials table so it can be used to login into these VMs to perform server-level discovery 

4. What level of access, does our AWS Service account ID should have. ? i.e Local admins rights.. etc..  ? 

Answer - The AWS Service account only discovers your cloud layer which will populate the VM Instance table and you will need to create a Master account with the default ‘OrganizationAccountAccessRole’ role for that. But to discover the server layer (windows server) in your case, you need windows local admin credentials for all the servers. It could be the same credentials or you need to create multiple credentials for each server if all the servers have a different 

5. To get successful AWS discovery, can you please list out the items to be configured. I have listed out few as per my knowledge. Please help me to fill if i missed any. 

Answer -       

1. AWS Service Account 

2. AWS Account ID

3. Windows MID Server reachable to ServiceNow and your AWS Org

4. Ports required for specific type of CIs- 

SSH​	Should have port 22 port open​
WMI​	Should have port 135 port open​
SNMP - Network​	Should have 161 and 162 port open​
WBEM​	Should have 5989 and 5988 port open​
PowerShell​	Should have v3.0 to 5.1​

5.  Does AWS Credentials will automatically will discover all the CIs in AWS Cloud. Or like On-Prem discover, do we need our service account to be installed in each CIs. ?   

Answer - No, AWS Credentials cannot automatically discover all Server layer details, you still need local credentials for each server to run a discovery. 

Please go through the product documentation as this will help you a lot with all the above queries - https://docs.servicenow.com/en-US/bundle/tokyo-it-operations-management/page/product/discovery/conce...

Thanks
-Harneet Sital
Request you to please mark my answer as HELPFUL or CORRECT based on the impact
Find all my ServiceNow articles here

[Keerthy S]

Hi @Harneet Sital 

Thanks for the detailed response. 

Yes, we are discovering the AWS VM's., Mean while in the discovery logs we are seeing Warring message: "unable to establish the connect to https://10.0.X.X/sdk  ---> So i need to make sure the VMware credentials which is configured in ServiceNow is reachable via AWS MID Server with 443 port... Please suggest if it's different method for AWS Cloud. 

So I need to take below actions:-

1. We are looking for cmdb_ci_win_server and cmdb_ci_linux_server Class table. We do have Windows/Linux credentials to discovery for On-Prem CIs. i will inform Cloud team to install these credentials with Local admin rights for all servers in AWS Cloud infra. 

2. In Cloud Infra, each Server CIs we should have the below Ports opened 

• SSH​ -Should have port 22 port open​

• WMI​ - Should have port 135 port open​

• SNMP - Network​  - Should have 161 and 162 port open​

• WBEM​ - Should have 5989 and 5988 port open​

• PowerShell​ - Should have v3.0 to 5.1

3. Check whether Master account has with the default ‘OrganizationAccountAccessRole’ role. 

Hope i am covering all the pending actions items to address. Please guide me if i am missing any tasks. 

Thank You.

Regards,

Keerthy.

[Harneet Sital]

Hi @Keerthy S 

You are absolutely right about all your points above. Hopefully making sure of all the points will sort your issue out. 

May I please know if the above has resolved your query? If so, please mark the answer as correct and helpful so the thread can be closed and would help others with a similar query. 

Thanks, 
Harneet

[Keerthy S]

Hi @Harneet Sital 

Mean while, forgot to ask.. In AWS the CIs information are stored as below format, for example

CI Name: windowsci123   IP: 10.0.5.7

When it is discovered in our CMDB, it is stored as below format as per the design.

Name: i-10.0.5.7   IP: 10.0.5.7 

Can you please guide me how to bring/update the actual name (windowsci123) to the "Name" field in CMDB via discovery. 

Regards,

Keerthy. 

[AneR]

When I made the switch, I faced similar questions about discovering server CIs. Here's what worked for me: I reached out to the Cloud Engineering Team for guidance. Turns out, they had a streamlined process that didn't require configuring service accounts on each host machine. It's like finding a shortcut in a maze! Oh, and speaking of shortcuts, stumbled upon some invaluable contracts at https://atpgov.com/contracts/2git/ that helped streamline our transition even further.