Discovery: when are records for running processes a) created; b) updated; c) not changed; d) deleted?

[haldroid]

We are running nightly scans on our Linux servers. The table Running Processes [cmdb_running_process] is of interest for config audit and diagnostics. From one scan to the next, suppose a process is restarted and returns with a new PID - is a new running process record created and the old one deleted? Is the original record updated? Same questions if a parameter is changed ... If there is no change to PID & parameters on a scan, is the running process record updated? What determines when/if a running process record is deleted? I haven't found anything in the docs on this. Flowchart or pseudocode would help!

We have similar questions for discovered applications, but I'm going to put them under a separate topic.

[doug_schulze]

Hal,

going to have to give you a new nick-name .. "Hal the bug hunter" 🙂 Yes indeed what happens is when we dont find a running process that was there before is to not delete the entry but actually set an 'absent' attribute to the record, basically hiding it..you can see that in the related list of processes on your computer record in the filter absent is false. and we do this for the majority of those related items on a record.

Now in researching this I found a bug where we are not coalescing correctly on processes that were restarted and I have a bug opened up and will be straightened out here shortly.

[KingSukh]

Hi Doug,

I would like to know the solution to this bug you posted, and also when we try to log the current.parameters, and current.key_parameters in the Process Classification routine they come up as undefined.

gs.log(current.parameters);

gs.log(current.key_parameters);

Can they be modified the in the process handler and passed to the process classification routine ?

Best Regards,
Sukhjinder   S Gill

[doug_schulze]

they put in Process Classifications - ServiceNow Wiki to assist with the original issue Hal Snyder reported...

[cyked]

Hi Doug.   How does discovery handle "re"-finding a running process on a server after finding it absent from a previous discovery?     What is the match criteria used to find existing running processes (absent or non-absent) vs identifying it as a new one?

Another question on your link to the wiki, specifically on process handlers, correct?   The function there is to be able to alter a running process parameter (only, not its PID or other values) to "remove" any text expected to change so discovery does not treat it as a new running process (and then likely creating a new App Server CI on classification because something changed), correct?