Deeper understanding of the Discovery processes.

humblecommitted · ‎11-07-2016

Hello Community,

I had a few questions on the Discovery process with ServiceNow:

How does the Discovery schedule call upon probes?
- does it run through all probes configured on the instance, or
- do you configure specific probes to run?
  - if so where do we go to attach what probes to run on the scheduled discovery?
Correct me if I am wrong, but what I gather from ECC Queue is the probes that ran will be stored here for review?
I noticed pre-configured OOB sensors in ServiceNow and they take the information gathered from the probes and converts them to data to populate the ServiceNow CI, what if we have special commands that run powershell or special ssh commands, how do use these sensors to capture these outputs?
- Do we have to script a special javascript to convert this data?
- is there OOB scripts that we can use to capture the probe outputs of the special commands that were run?

Thanks in advance.

Sincerely,

Humble committed student.

glennpinto · ‎11-07-2016

See answers inline:

How does the Discovery schedule call upon probes?
- does it run through all probes configured on the instance, or

Discovery goes through 4 phases:

1. Shazzam: Port scan to see what type of device responds (Windows, UNIX, SNMP)

2. Classify: Determines exact type of device (i.e Windows 2003)

3. Identify: Determine to insert or update a CI

4. Exploration: Discovers additional attributes on device (i.e. CPU, Memory etc)

So discovery only uses the probes and sensors needed for a specific type of device

do you configure specific probes to run?

Baseline, discovery deploys all the needed probes/sensors automatically to discover a specific type of device.

if so where do we go to attach what probes to run on the scheduled discovery?

If you build your own probe to discover attributes of a device that are not collected in a baseline instance, you would have to add the probe to the trigger probe list of the specific classifier you want it to run for (see the classifiers under Discovery Definition > CI Classifier, this is where you would add your own probes to be deployed for a certain type of device, i.e. solaris, switch, windows 2008)

Correct me if I am wrong, but what I gather from ECC Queue is the probes that ran will be stored here for review?

Yes, this will show all probes deployed and the results returned from each probes if you view the details of the input record.

I noticed pre-configured OOB sensors in ServiceNow and they take the information gathered from the probes and converts them to data to populate the ServiceNow CI, what if we have special commands that run powershell or special ssh commands, how do use these sensors to capture these outputs?
- Do we have to script a special javascript to convert this data?
- is there OOB scripts that we can use to capture the probe outputs of the special commands that were run?

If you build your own probe you will have to build your own sensor in order to parse the data returned in the payload from the execution of the probe on the target. I would view some of the baseline sensors to see how they are configured to react to a specific probe. From the sensor you can add your logic to write specific data returned from the probe execution to a specific field for the CI in the CMDB. This is one of the few areas when working with Discovery where you will need to have javascript skills. Most of Discovery requires only configuration and knowlege of networking/operating systems.

Additionally we have a 2 day Discovery training that takes you through all the ins and outs of running Discovery and building probes/sensors. Highly recommended to take this training to save time in the learning process.

See link below.

ServiceNow Discovery

View solution in original post

humblecommitted · ‎11-07-2016

Thank you Glenn for the thorough answers.

This helped clarify a lot of the questions I had!