Discovery log is too large and could not be saved

[Leo34]

Hi,

we have repeated errors in the log about a horizontal discovery pattern failing for some IPs.

However when trying to open the pattern log, it shows the message "Discovery log is too large and could not be saved".

Is there a property to increase the maximum size for pattern logs (temporarily)?

I found another question about this topic (https://community.servicenow.com/community?id=community_question&sys_id=e1a97a0fdb4773400be6a345ca96194b) but no useful answer.

The pattern in question is the original "Linux Server" pattern that comes with ServiceNow.

Thank you

[Patrick DeCarl1]

Hi Leo, 

Not sure if this will work, but try to update the "log" column max length under table "sa_discovery_log". Let me know if that works. 

[Leo34]

Hi Patrick,

good idea, however I found that the "log" column is of type "Compressed" and that does not seem to allow changing length.

[Jim Zeigler1]

I had the same issue at 2 customers when the default settings caused most of the results shown in the log to be truncated. The mid server property mid.sm.discolog.max_object_size controls the maximum size of an object (e.g. data returned from a rest call or an SNMP query) in the Pattern's discovery log. 

You will also need to put the same value in the dictionary max length for the sa_discovery_log* tables, column=Log Message(log)

I found that setting it too high can cause other issues(even if you bump up the agent's memory footprint). The  results from steps with a large payload may not be not included in the log (making it hard to troubleshoot the section of the pattern). In the log, when you get the following message: "Discovery Log is too large and could not be saved", it is advised to lower the value so you get a discovery log.

If it is set too small (e.g. 1000) it can affect discovery execution, especially if the next step depends on parsing the full object returned, not just the truncated part of the object.

I found a value of 20-125K to be large enough for discovery of large load balancers with thousands of LB servces.

If an object returned by discovery is too large to display in the logs, it should not affect execution of the pattern.

There is another community post at Is it a good idea and safe to set mid server property mid.sm.discolog.max_object_size value to 50000... concerning this issue.

[Leo34]

Hi Jim,

thanks, that's good information.

I tried raising the value of mid.sm.discolog.max_object_size quite a bit (up to 1.000.000) but it did not help unfortunately.

It won't show me the log at all, just saying it's too large.