Discovery- How to separate Workstation and Server schedules

[Lakshmi Prabha]

We have implemented ServiceNow Discovery and configured schedules to perform scan. We need to run only Workstation scan during the day. If we add the behavior as WMI then it scans both Workstation and Servers.

We won't be able segregate the IP ranges for Workstaions and Servers. Workstaion and Server IP ranges were mixed up.

Is there a way we can run Workstation scans during the day and Server scan over the night?

[snoop]

Hi,

I am assuming that your servers and clients are likely to be mostly running Windows. If that is the case then you cannot separate the schedules other than by IP ranges as the capabilities will need to be the same for both. Are you clients not allocated their IP addresses via a DHCP server ? (Servers are usually fixed IP and clients DHCP). If so then you could export those range(s) and import them into ServiceNow.

If you cannot separate them by IP address then I think you are stuck, sorry.

HTH Andy

[Dave Smith1]

Pretty much what Andy said.  

Discovery can only determine if it's a server or workstation by scanning it, and if you want scans to only target specific nodes then you'll need some selection criteria outside of a scan to determine your targets (such as IPs, network ranges, etc).

It sounds like your problem stems from the fact that there was no structure during IP address allocation.   Perhaps tackling that issue and formalising a good working structure then migrating over to that model can help not only Discovery, but future allocations also.

As Andy mentioned, most organisations put servers on a static range then use another range for other devices, issued by DHCP - so the groups of servers/end-user devices are more easily identifiable.

[Dave Smith1]

Actually, there IS a way:

• Setup two schedules, a day one and a night one.
• have the IP ranges of the servers added into the server schedule
• add those IP ranges in as an exclude list for the workstation schedule

This is quite a bit of work, but currently as there's no automatic way of determining which is a server and what's a client, someone will have to whitelist/blacklist the known server IPs.

An alternative approach is to build in a classify probe that performs a detection for workstation/server and exits early in the process, so they're discovered but it doesn't get as far as Identify/Explore for a server.

Generally, it's doable. But it's quite a bit of work.

[snoop]

Dave

I think you've missed his comment that they don't actually have different ranges or knowledge of which IPs are workstations and servers. If they had these then yes it would be very simple to setup different schedules and in fact I would recommend different schedules as servers are best typically discovered overnight and client during the day (often a morning and afternoon schedules)

With regards to adjusting the classify probes this only really half addresses the issues as you would actually be scanning everything anyway to some point. I agree you could then stop the rest of the discovery but you have started it so you might almost just as well finish it.

I would agree suggest here that the issue would be correct resolved by setting up correct DHCP scopes for clients in specific IP ranges. That is actually the correct solution to the issue

Andy