"Alive, not active, not classified" Devices Appear In Discovery Results Whether "Include Alive" Checked Or Not

[Tom Rausch]

When I run a Discovery Schedule, "Alive, not active, not classified" Devices appear in the Discovery Results whether "Include Alive" is checked or not. How can I remove the "Alive, not active, not classified" Devices from the Discovery results?

Background

I setup a Discovery Schedule. I check "Include Alive".

I then run the Schedule.

In the Shazzam results, five IP addresses are found to be "active=false" and "alive=true". Only one of the five is shown in the screenshot below, but all five are listed in the Shazzam log.

• 10.2.133.2
• 10.2.133.106
• 10.2.133.109
• 10.2.133.110
• 10.2.133.112

As expected, these five IP addresses appear in the Discovery results as Devices "Alive, not active, not classified"

I return to the same Discovery Schedule. I uncheck "Include Alive", then Save the changes.

I then run the same Schedule with "Include alive" not checked. The same five IP addresses appear in the Discovery results as Devices "Alive, not active, not classified". This is not expected. Should the Discovery results omit all Devices that are "Alive not active not classified"?

[Vivektietsood]

Alive, not classified" typically means that the target host responded on port(s),but didn't have credentials to get any further info ? Are you trying to do credential less discovery if not then I would suggest inputting credentials and use in credential alias and then trying this again, a lot of multiple Ips etc get resolved when proper credentials are supplied for discovery to login to the device and completing scanning. 

Please mark helpful or accept solution so that it helps others with a similar question.

[Tom Rausch]

Hello, @Vivektietsood,

>"Alive, not classified" typically means that the target host responded on port(s),but didn't have credentials to get any further info

Actually, "Alive, not active, not classified" means Shazzam attempted to find open ports but was refused. You can see this in the Shazzam results for IP address 10.2.133.2. All the Shazzam ports are refused except for one which is "io_error."

Since no ports are open, the presence of credentials is moot. If there is no access on the relevant port, no credential will ever work.

My concern is that checking the "Include Alive" box in the Discovery Schedule makes no difference in the presentation of the results.

• If I check the "Include Alive" box, the "Alive, not active, not classified" IP addresses appear in the "Devices" list.
• If I do not check the "Include Alive" box, the "Alive, not active, not classified" IP addresses still appear in the "Devices" list.

There is no difference whether I check the "Include Alive" box or not.

[Vivektietsood]

yes I agree about not active part, that the ports were not open. Did you try excluding the IPs from scanning - https://docs.servicenow.com/bundle/geneva-it-operations-management/page/product/discovery/task/t_Exc...

If you dont wan the IPs to appear at all maybe excluding them from scanning using the above link.

I agree that the flag - Include Alive" box should work. I hope the above option I described helps. 

Please mark helpful or accept solution so that it helps others with a similar question.

[Tom Rausch]

> If you dont wan the IPs to appear at all maybe excluding them from scanning using the above link.

I do want them to appear when I check the "Include alive" box. Therefore, excluding the IP addresses from the Discovery scan is not a practical option going forward.

> I agree that the flag - Include Alive" box should work.

Regrettably, the flag "Include alive" does NOT work. Perhaps someone from ServiceNow can assist us and tell us why it does not work.