How do I determine why Discovery is not discovering a server?

rmeyer · ‎01-11-2016

The IP for the server is within a scheduled range. I have also tried Discover CI for the specific IP. I have the ECC Queue input results from Shazzam. The input results contain the DNS but no CI is created or updated (CI actually already exists but has a different IP which I thought that Discovery should be updating for me).

tim_broberg · ‎01-12-2016

Roger, if you look at the shazzam input record on the ecc queue, you should see the results for his port scans.

SunOS solaris_pfexec 5.10 Generic_147441-01 i86pc<community_string>public<snmp_version>0<banner_text>SSH-2.0-Sun_SSH_1.1.4<banner_bytes>.53.53.48.2d.32.2e.30.2d.53.75.6e.5f.53.53.48.5f.31.2e.31.2e.34.0a.

For the device to discover, it needs, result="open", for the relevant ports. For example, unix servers will not discover if port 22 is open (or a separate port probe is created for other ssh ports).

View solution in original post

tim_broberg · ‎01-12-2016

Gah, I can't get that formatted well above. Sorry. Insufficient time.

What you can do, Roger, is look at your discovery results. The "Devices" tab shows what was discovered. The "Completed Activity" column tells you the results of discovery. The ones marked "Active, couldn't classify" have issues to be resolved such as missing credentials or closed ports.

rmeyer · ‎01-12-2016

Tim - the problem is the two servers I have been asking about don't show up in the Devices tab so there was nothing to tell me that they were missed.

Again I certainly appreciate your help and will work to get the ports opened (is 53 ok with a response of resolved rather than open?) Then I will work to figure out a way either inside SN or outside of it to determine if I have other servers with closed ports.

Ankush13 · ‎01-12-2016

Port 53 is dns. Resolved shows that server has dns entry which is good. Did you telnet the port to check if the server has it in listening state? If it is, try running remote WMI query to see the account permissions.

Ryan Zulli · ‎01-15-2016

Hi Roger,

What type of device is this? Since you're not getting out of the first phase (Shazzam) you'll need to address ports that we Classify on (135 for windows, 22 for SSH, 161 for snmp..etc)