Query on Discovery Schedule Best Practice

[shank1]

Hello,

1. Assuming there is 1 mid server and a total of 1200 to be scanned, can I create multiple  'Discovery IP Ranges' in a single Discovery Schedule <or> split the IP's into multiple Discovery Schedules.

2. Assuming there are 5K devices, 1 mid server and I create 5 Discovery Schedules, each one targeting 1K IP's. Here should I run them sequentially using the 'Run After' or can I run all the schedules at once.

PS. I know that best practice depends on the various factors, but I am just looking for the above scenario.

Thanks

Shanks

[knoxkf]

Hi - like you said many factors...  but what we have done..  

I have several mid servers and put them in clusters so if the mid server goes down, the job will continue to run.

I try to schedule the jobs to run during off business hours. 

I also do not schedule anything on Sundays.

I define a specific IP subnet per job - so Job A - 10.10.10.0/24 scheduled at 01:00 AM.  Job B 10.10.15.0/22 at 01:15 AM etc..

I do have overlapping schedules - because we have no choice if we want to get the job done.

Hope that helps.

[MrMuhammad]

Hi Shanks,

Please find my responses in RED.

1. Assuming there is 1 mid server and a total of 1200 to be scanned, can I create multiple  'Discovery IP Ranges' in a single Discovery Schedule <or> split the IP's into multiple Discovery Schedules. MID server is all about location.  As in your case, you have 1 MID server and 1200 devices that is not a big number for MID server to handle until it is placed in best location, close to target. Now, if you go for multiple discovery schedules or single it would not have any major impact on performance. If these devices include Network devices then you must consult with your concerned department and schedule discovery for the hour when traffic is at lowest (in the off hours) that way you will be able to discovery most accurate numbers.

2. Assuming there are 5K devices, 1 mid server and I create 5 Discovery Schedules, each one targeting 1K IP's. Here should I run them sequentially using the 'Run After' or can I run all the schedules at once. Again it depends on MID server because he is main guy handling everything for you. If you run all at once with 1 MID server then it doesn't make any sense of dividing IP ranges into multiple Discovery schedules. These discovery schedules should sequentially. 

Please mark this accepted & helpful if it answered your question.

Thanks & Regards,
Sharjeel

[PV MADHU · Accepted solution]

Hello Shanks,

Q1 : Assuming there is 1 mid server and a total of 1200 to be scanned, can I create multiple  'Discovery IP Ranges' in a single Discovery Schedule <or> split the IP's into multiple Discovery Schedules.

A :  

Step 1: Identify the IP Subnet Range if they contain all devices ( Windows , SSH , SNMP , etc ) 

Step 2 : If yes then consider running them as per the device types else ask your network team the appropriate IP Ranges for respective devices . ensure that discovery doesn't run on the same IP's in each schedules.

B:

The Best practice is to evaluate the average time taken for each schedule and run them subsequently and also equally important to consider the below factors and decide accordingly . 

• The Performance depends on the hardware configurations,
• Devices types your are discovering and corresponding probes /patterns launched 
• Evaluate the numbers of threads launched on the host machine and impact of the CPU on the host machine
• Consider increasing JVM memory if Discovery jobs are running slow 

Note : Please mark this accepted & helpful if it answered your question.

[Gaurav Shirsat]

Hi Shanks

Use one or more of these methods in any combination to define the network or network segment for Discovery to query. You can include or exclude specific IP ranges from your query.

• If you do not know the IP addresses in the network, run Network discovery first to determine the IP networks. Then, convert the IP networks into IP address range sets.
• If you have integrations which populate sys_metadata and sys_update_xml tables, make sure to clear the update and metadata records after the discovery_range_item or discovery_range_item_ip import occurs.

1. IP Address List:-Use IP address lists to add individual addresses to query. These addresses are not included in any existing IP range or IP network. You can enter the IP address of the device or a host name (DNS name). If you enter a host name, it must be mapped to an IP address.
2. IP Address Range:-You can define arbitrary ranges of IP addresses to query. This process is a good way to include selected segments of a network or subnet. However, Discovery has no way of knowing if the IP range includes addresses for private networks or broadcast addresses, and scans all the addresses in the range. If the network and broadcast addresses are included, then the results are inaccurate. Discoveries configured to detect IP networks are more accurate than discoveries configured for IP address ranges. Only those IP addresses in your range that are reserved for manageable devices on the public network should be included.
3. To avoid any possible performance issues, limit Discovery schedules to a maximum range of /16 or no more than 65,000 IPs. You can also split the Discovery schedules into even smaller ranges of IP addresses.

• IP Network:-You can also scan an entire IP network. An IP network includes the range of available IP addresses in that network. The scan also includes the network address (the lowest address in the range) and the broadcast address (the highest address in the range). After you run network discovery, convert the IP networks that were found into range sets for use in discovering other devices.An example of a class C network range is 192.168.0.0 to 192.168.0.255. In the Range Set form, this network can be entered with either of the following notations:
• 192.168.0.0/24
• 192.168.0.1/255.255.255.0

This notation indicates that Discovery is scanning an IP network, and does not scan the highest and lowest numbers in the range. Significant errors are prevented and introduced into the Discovery data by the broadcast address. All devices are returned in the network, and the network address, which can add an arbitrary number of redundant devices. This built-in control makes IP networks the best method of defining which IP address ranges to query.

Please Refer the Below Links:-

https://docs.servicenow.com/bundle/orlando-it-operations-management/page/product/discovery/reference...

Please Mark Correct and Helpful

Thanks and Regards

Gaurav Shirsat