How to report on discovered Changes to a CI

[RKinder]

Is there a way to report on updates to a CI made by discovery? For example if someone had installed new software on a server but bypassed the change process so there is no actual Change record, how can we report on the detection of that change to the CI.
Thanks

[tgay001]

You can tell which CIs were updated by Discovery by filtering on the 'Updated by' field. If it was updated last by Discovery, the username posted will be that of the midserver (perhaps mid.server or something similar). This tells you that the midserver did the update and not a process user. Does that help?


Tiffany Gay
Service Delivery Manager, Navigis

[RKinder]

Thanks very much for your reply.
I'm aware that we can report/query on who updated and when and all that, but a majority of my team was put under the impression that we could report on what was changed.
While I can look at the audit timeline and find a few changes such as where it previously didn't have a value for RAM or something and then it did. But the goal is to be able to detect undocumented changes.
So someone installed new software.. how can we tell. Someone changed a configuration of something, how can we tell? Or can we at all?
Thanks.

[dturner]

I was thinking of doing something similar...

Within each Discovery Log for a Discovery run, you'll see items such as:
Updated device fields OS Version OS - AIX Server SSHCommand
for an aix box, or:

Updated device fields RAM (MB)Windows - CPU / MemoryComputerWMIRunner
for a Windows workstation.

Clearly the RAM was upgraded since it was last discovered and the OS on the AIX box was upgraded. I think the effort is in linking this to Change, and creating a report that includes specific log items such as this.
If you have a rotating schedule that would discover any changes, then run a report that shows those changes by using First Discovered On as a reporting field? That can be compared with CI's that were not supposed to change (in some manner I'm not yet sure of).

I hope that is helpful somehow 🙂

[amadosierra]

I think a more appropriate way of doing this will be by using the baseline functionality: http://wiki.servicenow.com/index.php?title=Baseline_CMDB

Basically it will do this:
The ability to create a snapshot of your configuration items called a baseline and then look at all the changes that have been made to that configuration item since a given baseline. Multiple baselines may be created and the system will track the changes that have been made per baseline. When a baseline is created, the attributes of the CI are captured as well as all first level relationships for the CI. Any changes to the base CI or to any related CI will be captured and displayed.