NMAP Credentialess discovery changing CI class

[John Skiba]

In testing to enable NMAP discovery, we noticed that it will change the class of some of the CI's we have from say AIX Server to Hardware.  Hardware appears to be the default.  Now granted the items it changes are usually manually created CI's at some point however, we would like to turn off this behavior. 

What to do we have to do to make sure that NMAP discovery doesn't change the class of the CI?

(currently San Diego, upgrading to Utah within month)

[CBartram]

You might be able to stop the "downgrade" of previously created CIs by disabling the system property "glide.class.downgrade.enabled" ?

[John Skiba]

That would be great if it was explicit for credentialless discovery only.  Is there a way to just set it for credentialless? 

[John Skiba]

We have looked at all three properties.  
https://docs.servicenow.com/bundle/washingtondc-servicenow-platform/page/product/configuration-manag...

• glide.class.upgrade.enabled
• glide.class.downgrade.enabled
• glide.class.switch.enabled

We actually have set to false glide.class.upgrade.enabled set to false as a temporary fix.   This keeps credential-less discover from moving configuration items OUT of cmdb_ci_hardware to cmdb_ci_linux_server or cmdb_ci_windows_server based on if the device identifies OS Family of Linux or Windows.

We also tried glide.class.switch.enabled to prevent credentialess from ping ponging classes when our configuration item owners set a PLC device to OT class. However, credentialess finds a new device and just because it identifies as Linux, credentialess moves it to Linux Server.

We have not enabled false for glide.class.switch.enabled because we noticed in testing that discovery of a device works, but then at the end at payload processing it fails and exits.  Problem with this is, it doesn't update anything in the CI and the CI becomes stale.  It's as if discovery didn't even run.

The other issue is, the properties don't appear to be credentialess specific.   So, if ServiceNow develops a pattern or we develop a pattern, then those CIs won't update to the new class.

Ideally, there would be some credential-less specific properties as credential-less is a very basic first step of shell CI creation.  I would like it to just place all CI which are discovered by credential less in cmdb_ci_hardware table as a staging area and when the owners review them and move them to appropriate class table, they should remain there.   Is there a way to accomplish this?

ServiceNow's documentation clearly states that anything that identifies OS Family from NMAP of Linux, they place it in Linux Server class (cmdb_ci_linux_server).  And so on.  I don't understand the logic of this type of assumption.  How are all devices that have a Linux kernel considered a Linux server?

Supported OS familiesOS family CI table

AIX	cmdb_ci_aix_server
HP-UX	cmdb_ci_hpux_server
Linux	cmdb_ci_linux_server
Solaris	cmdb_ci_solaris_server
OS X or iOS	cmdb_ci_osx_server
Windows	cmdb_ci_win_server
Undefined	cmdb_ci_hardware

https://docs.servicenow.com/bundle/washingtondc-it-operations-management/page/product/discovery/refe...

However, this is causing flopping massive issues for thousands of configuration items because scanning the network detects IOT devices (IP Desk Phones, Security cameras, OT devices, anything with Linux kernel) and placing it or moving it into cmdb_ci_linux_server class.   Obviously these are not servers and this causes data issues for the server folks.

We have opened up a ticket recently, but the response was they recommend configuring the credential-based discovery that will not move a configuration item.   Yes, we do this for the items we care about.  However, many other types which we currently don't have a use case for to allocate resources too for something like IP desk phones.

What other options are possible?

[Nick Hynes]

I have a similar issue but in my case Credentialless Discovery is incorrectly switching the class of CI's pulled in from Intune as Computers and changing them to Windows Servers.  I can't find a way in reconcilliation rules of stopping Class being overwritten.