CIM discovery fails with "5 000 milliseconds timeout on connection http-outgoing"

[Ricky S Larsson]

The last week we've noticed that our IBM SVC discovery have started to fail. The problem is at the CIM classification. In the CIM - Classify input payload the following result is returned:

<results error="5 000 milliseconds timeout on connection http-outgoing-5 [ACTIVE]" probe_time="10141" result_code="900000">
<result/>

The http-outgoing have had other numbers like 1 or 3. I have tried changing the value of CIM probe parameters "connection_timeout" and "socket_timeout" without any different result.

I have confirmed that the wbem port is opened, both by telnet from the MID server and in the shazzam input

<scanner name="GenericTCP" port="5989" portprobe="wbem" protocol="tcp" result="open" service="wbem_https"/>

The SVC discovery was working about 1-2 weeks ago. Sadly the ECC queue records are now gone so it's hard to compare and see what has changed.

Anyone else that encountered this issue?

EDIT: By advice from ServiceNow Support I added credentials for SSH to complete the UNIX Classify. This didn't solve the 5000 milliseconds timeout issue And another warning message now appears as well:

No shell detected and probe parameter 'allow_unsupported_shells' is set to 'false'

[Ricky S Larsson]

By advice from ServiceNow Support I added credentials for SSH to complete the UNIX Classify. This didn't solve the 5000 milliseconds timeout issue And another warning message now appears as well:

No shell detected and probe parameter 'allow_unsupported_shells' is set to 'false'

[Maik Skoddow]

Hi @Richard S Larsson ,

I found that document on internet: https://docuri.com/download/discovery-improvements_59c1dcbcf581710b2868c7e2_pdf

Maybe it helps.

Kind regards
Maik

[Ricky S Larsson]

Thank you!

I have missed in the documentation that port SLP 427 needs to be open as well, not only 5989 because CIM use SLP queries. On port scan we get refused on SLP 427.

<scanner name="SLP" port="427" portprobe="slp" protocol="udp" result="refused" service="slp"/>

Either the port has been open or it hasn't had be open because we were able to successfully do a CIM discovery before.

I have contacted our Network team and asked them to open 427 and will return with an answer if it helped or not.

[Ricky S Larsson]

Opening 427 didn't help unfortunately, still the same errors.

My ticket at ServiceNow Support is still work in progress, we'll see if they can find out where the issue is.

[Ricky S Larsson]

Opening 427 didn't help unfortunately, still the same errors.

My ticket at ServiceNow Support is still work in progress, we'll see if they can find out where the issue is.