How Mid server run probes

[Gowtham2]

How does discovery happens through mid server while discovering? Does mid server send probes to certain number of IP's parallel or it discover CI's one after another?

[tim_broberg]

The instance posts messages in the ecc_queue table and sends a message to the mid via AMB.

The mid slowly polls the ecc_queue table, and polls immediately on receipt of the AMB message.

The ecc_queue output messages instruct the mid to run commands, he runs them, and returns results in the ecc_queue input messages.

The mid may prefetch quite a lot of commands, but he runs up to threads.max commands at a time on the standard queue. (Details here.)

At the beginning of discovery, the instance will send Shazzam probes to the mid. This instructs the mid to perform a port scan.

Based on the open ports for each IP, the instance will send classify probes to the mid which will provide sufficient information to figure out what kind of thing the target is.

Once the instance knows what it is, it will send a identify probes to match the IP to a CI, or create a new one if necessary.

Then all hell breaks loose. Up until now, it's been no more than one probe per IP. Once the device is identified, the instance sends lots of probes to actually explore the device. There can be dozens. At this point, the mid will most likely hit the threads.max limit for a while, and the instance will pile lots of ecc_queue output records up waiting for processing.

Eventually, the mid will catch up, assuming you aren't running still more discoveries in the mean time.

    - Tim.

[Sandeep Kumar6 · Accepted solution]

Hi Madhav,

I think i understood your questions. please find the answers of your question below.

1. How does discovery happens through mid server while discovering : - 

https://docs.servicenow.com/bundle/helsinki-it-operations-management/page/product/discovery/concept/c_NoSecrets.html

https://docs.servicenow.com/bundle/kingston-it-operations-management/page/product/mid-server/concept/c-

MIDServerSelectionSequence.html

2. Does mid server send probes to certain number of IP's parallel or it discover CI's one after another :-

The answer is Yes it sends probes in parallel to CI but the condition is it can send only 5000 CI at a time.

The default shazzam batch size present on the servicenow instance is 5000, which means that a total of CI's can be polled at once is 5000.  This property can be altered as per the requirements too.

Please hit helpful or answer if it resolved your queries.

Regards

Sandeep