Discovery failing - WMI Classify - "timed out after PT5M"

[jcanjura]

Hi,

Discovery is failing on some Windows servers with the error below:

- Test Credentials works fine on the target box.
- Also saw the exact error described on KB0781997, and made the suggested change but that didn't help.

Error:

error="Command [snc-decode-command JiB7IGV4ZWN1dGVXaW5kb3dzQ2xhc3NpZnkgLXdtaUZldGNoRGF0YSAncm9vdFx2aXJ0dWFsaXphdGlvblx2MlxNc3ZtX0NvbXB1dGVyU3lzdGVtLk5hbWUsSEtFWV9MT0NBTF9NQUNISU5FL1NZU1RFTS9DdXJyZW50Q29udHJvbFNldC9TZXJ2aWNlcy9UY3BpcC9QYXJhbWV0ZXJzL0RvbWFpbixIS0VZX0xPQ0FMX01BQ0hJTkUvU1lTVEVNL0N1cnJlbnRDb250cm9sU2V0L1NlcnZpY2VzL1RjcGlwL1BhcmFtZXRlcnMvSG9zdG5hbWUscm9vdFxNU0NsdXN0ZXJcTVNDbHVzdGVyX1Jlc291cmNlLlByaXZhdGVQcm9wZXJ0aWVzLHJvb3RcTVNDbHVzdGVyXE1TQ2x1c3Rlcl9SZXNvdXJjZS5OYW1lLHJvb3RcTVNDbHVzdGVyXE1TQ2x1c3Rlcl9Ob2RlLk5hbWUscm9vdFxNU0NsdXN0ZXJcTVNDbHVzdGVyX0NsdXN0ZXIuTmFtZSxyb290XE1TQ2x1c3RlclxNU0NsdXN0ZXJfQ2x1c3RlclRvUmVzb3VyY2UuR3JvdXBDb21wb25lbnQscm9vdFxNU0NsdXN0ZXJcTVNDbHVzdGVyX0NsdXN0ZXJUb1Jlc291cmNlLlBhcnRDb21wb25lbnQscm9vdFxNU0NsdXN0ZXJcTVNDbHVzdGVyX0NsdXN0ZXJUb05vZGUuQW50ZWNlZGVudCxyb290XE1TQ2x1c3RlclxNU0NsdXN0ZXJfQ2x1c3RlclRvTm9kZS5EZXBlbmRlbnQscm9vdFx2aXJ0dWFsaXphdGlvblxNc3ZtX0NvbXB1dGVyU3lzdGVtLk5hbWUscm9vdFxNU0NsdXN0ZXJcTVNDbHVzdGVyX1Jlc291cmNlLlR5cGUsV2luMzJfQ29tcHV0ZXJTeXN0ZW0uRG9tYWluLFdpbjMyX0NvbXB1dGVyU3lzdGVtLk5hbWUsV2luMzJfT3BlcmF0aW5nU3lzdGVtLkNhcHRpb24sV2luMzJfT3BlcmF0aW5nU3lzdGVtLlZlcnNpb24nIC1maWx0ZXJIb3RmaXggJHRydWUgLW91dHB1dEZvcm1hdCAnanNvbicgfSB8IE91dC1TdHJpbmcgfCBGb3JFYWNoLU9iamVjdCB7IFtDb25zb2xlXTo6V3JpdGVMaW5lKCRfKSB9 | invoke-expression] timed out after PT5M" probe_time="402551" result_code="81">
<result error="Command [snc-decode-command JiB7IGV4ZWN1dGVXaW5kb3dzQ2xhc3NpZnkgLXdtaUZldGNoRGF0YSAncm9vdFx2aXJ0dWFsaXphdGlvblx2MlxNc3ZtX0NvbXB1dGVyU3lzdGVtLk5hbWUsSEtFWV9MT0NBTF9NQUNISU5FL1NZU1RFTS9DdXJyZW50Q29udHJvbFNldC9TZXJ2aWNlcy9UY3BpcC9QYXJhbWV0ZXJzL0RvbWFpbixIS0VZX0xPQ0FMX01BQ0hJTkUvU1lTVEVNL0N1cnJlbnRDb250cm9sU2V0L1NlcnZpY2VzL1RjcGlwL1BhcmFtZXRlcnMvSG9zdG5hbWUscm9vdFxNU0NsdXN0ZXJcTVNDbHVzdGVyX1Jlc291cmNlLlByaXZhdGVQcm9wZXJ0aWVzLHJvb3RcTVNDbHVzdGVyXE1TQ2x1c3Rlcl9SZXNvdXJjZS5OYW1lLHJvb3RcTVNDbHVzdGVyXE1TQ2x1c3Rlcl9Ob2RlLk5hbWUscm9vdFxNU0NsdXN0ZXJcTVNDbHVzdGVyX0NsdXN0ZXIuTmFtZSxyb290XE1TQ2x1c3RlclxNU0NsdXN0ZXJfQ2x1c3RlclRvUmVzb3VyY2UuR3JvdXBDb21wb25lbnQscm9vdFxNU0NsdXN0ZXJcTVNDbHVzdGVyX0NsdXN0ZXJUb1Jlc291cmNlLlBhcnRDb21wb25lbnQscm9vdFxNU0NsdXN0ZXJcTVNDbHVzdGVyX0NsdXN0ZXJUb05vZGUuQW50ZWNlZGVudCxyb290XE1TQ2x1c3RlclxNU0NsdXN0ZXJfQ2x1c3RlclRvTm9kZS5EZXBlbmRlbnQscm9vdFx2aXJ0dWFsaXphdGlvblxNc3ZtX0NvbXB1dGVyU3lzdGVtLk5hbWUscm9vdFxNU0NsdXN0ZXJcTVNDbHVzdGVyX1Jlc291cmNlLlR5cGUsV2luMzJfQ29tcHV0ZXJTeXN0ZW0uRG9tYWluLFdpbjMyX0NvbXB1dGVyU3lzdGVtLk5hbWUsV2luMzJfT3BlcmF0aW5nU3lzdGVtLkNhcHRpb24sV2luMzJfT3BlcmF0aW5nU3lzdGVtLlZlcnNpb24nIC1maWx0ZXJIb3RmaXggJHRydWUgLW91dHB1dEZvcm1hdCAnanNvbicgfSB8IE91dC1TdHJpbmcgfCBGb3JFYWNoLU9iamVjdCB7IFtDb25zb2xlXTo6V3JpdGVMaW5lKCRfKSB9 | invoke-expression] timed out after PT5M"/>

Any initial clue on the root-cause will be greatly appreciated.

Thanks.

[Sonia Shridhar1 · Accepted solution]

@jcanjura Have you tried increasing wmi_timeout ?

Please see this link it will be helpful

https://docs.servicenow.com/bundle/orlando-servicenow-platform/page/product/mid-server/reference/mid...

I hope the answer helps, Kindly Mark ✅ Correct or ???? Helpful if applicable., So that others get benefited in future for similar issues...

[jcanjura]

Hi Sonia, 

Increasing the "mid.windows.probe_timeout" made it.

We have a bunch of MID servers with a higher timeout, I guess I should had tried that before posting the question 😞

Thank you for pointing us in the right direction.

JC

[Rahul Priyadars]

is this also works.

A simple Powershell WMI query directly from the MID Server to the remote machine can be used to test access and permissions. 

Open a PowerShell command line on the host where the MID server is being used and run the following:

gwmi win32_operatingsystem -computer 192.168.200.14 -credential 'LOCALDOMAIN\mid'

Substitute LOCALDOMAIN\mid by the credential to test, and 192.168.200.14 with the target IP address. The expected result would be similar to:

SystemDirectory : C:\Windows\system32
Organization    :
BuildNumber     : 6001
RegisteredUser  : Windows User
SerialNumber    : 12345-OEM-1234567-12345
Version         : 6.0.6001

Regards
RP

[jcanjura]

Hi Rahul, 

This is the output from the debug session (I assume will be the same running it directly from the MID):

SystemDirectory : C:\windows\system32
Organization : xxx
BuildNumber : 14393
RegisteredUser : XXX
SerialNumber : 12345-33333-11111-12345
Version : 10.0.14393

Thanks,
JC