Discovery implementation challenge

[Ravish Shetty]

Hi all,

We are currently implementing ServiceNow Discovery as well as integrations with other data sources through APIs and Service Graph Connectors.

One challenge we are facing is that we are unable to scan production systems or retrieve data from production APIs from our non-production ServiceNow instances. At the same time, there is significant pressure to demonstrate progress and deliver results quickly. As a result, much of our Identification and Reconciliation Engine (IRE) testing and fine-tuning may need to occur directly in production.

How are other teams handling similar situations?

We also engaged ServiceNow to determine whether there is a way to intercept or stage data from Discovery and Service Graph Connectors before it is committed to the CMDB. Our goal was to simulate IRE processing and identify potential duplicate or reconciliation issues without impacting production data. However, it appears that these ingestion methods do not provide a staging-table mechanism that would allow for this type of testing.

We would appreciate any guidance or recommendations on how best to approach this.

Thanks,
Ravish

[Tanushree Maiti]

Hi @Ravish Shetty 

Refer this doc and try to debug:

KB0750382 How to capture Identification and Reconciliation Engine debug logs 

https://www.servicenow.com/docs/r/servicenow-platform/configuration-management-database-cmdb/ire.htm...

[drbob]

Can you clarify "unable to scan production systems or retrieve data from production APIs from our non-production ServiceNow instances" ?

Is it that you believe you should be able to but it is not working or that you are not allowed (intentionally or otherwise) ?

Examples of "not allowed"...

1) Each instance has its own MID servers which are probably hosted on distinct servers so if there are firewall rule changes in place between PROD MID servers and the discovery targets, those same rules will need updating to include the non-PROD MID servers else the discovery just won't reach the target.

2) Are the targets only allowing access from certain IP addresses - the non-PROD MID servers may need adding to whitelists on the devices.

In both these cases your discovery log should be pretty short "unreachable" or similar. To avoid masses of logs, pick a system that _does_ discover in PROD and try a quick discovery of that from non-PROD, you'll have much less log to read through.

If you are "allowed"...

1) Do you have the credentials in non-PROD? I think they are clone exempt so you would have to copy them down manually.

2) Once you get past this point then you're back to what Tanushree posted - you're getting the data but the CIs aren't creating/updating.