SQL Probe and WID

DuaneNMore · ‎11-21-2016

When I run a discovery against a Windows 2012R2 server, the SQL Server probe finds the Windows Internal Database and thinks we have a sqlserver. This is because this thing runs as C:\Windows\WID\Binn\sqlserver.exe. I think I'd like to ignore this particular instance, but the way discovery is set up, if it sees sqlserver.exe it thinks you are running sqlserver. Being new to discovery (took the class last week) I know there is a way, but I am uncertain how.

I also have the additional problem of installing the SQL management library (SMO) for when I do discover real sql servers but that is well known.

Ryan Zulli · ‎11-21-2016

Hi Duane,

The process classification is where you'd want to look...Discovery --> Discovery Definition --> CI Classification --> Processes. Click on the Microsoft SQL Server record and you'll see that we look for a condition where Command contains sqlserver.exe. Here you can add another condition, AND where Command IS NOT C:\Windows\WID\Binn\sqlserver.exe.

Of course the proper way would be to copy the OOB code and create a new record that way during the next update you can compare changes (if any).

Let me know if this helps.

Thanks,

-Ryan

View solution in original post

DuaneNMore · ‎11-23-2016

I have exactly the same set; same dates everything.

Dave Smith1 · ‎11-23-2016

Hmm.. I've just had a look at my Business Rules - I have one marked "Discovery - Complete" but this fires discovery.phase.complete... I can't see one that causes the discovery.complete event to fire, so unsure of how that event is raised.

The event itself does mention "script include DIscovery.complete()" - check to see if that hasn't been modified in your Script Includes.

As a test: could you script up something in another browser that calls gs.eventQueue("discovery.complete", current); and manually fire it about 2 mins after you start a discovery, see if that causes the status to change at all?

I'm slightly at a loss here, but it seems it's something small preventing the call that changes the status - just a matter of tracking it. If you're still stuck, I'd recommend getting a ticket raised and have someone more experienced than I trawl through the process and see where the hiccup lies.

DuaneNMore · ‎11-23-2016

Yeah, I am getting added to hi so that I can open an incident on this.

Thanks for your input.

Dave Smith1 · ‎11-23-2016

You're welcome, fellah. Do let us know what the issue was (and the fix) when it's resolved, eh? Put me out of my misery - I'm on tenterhooks here!

DuaneNMore · ‎11-29-2016

Something was busted in the Instance, after a bit of troubleshooting with Support we found that Events were not being processed. In particular we had 57000 events pending. This is an on-prem dev instance :O. ANyhow, someone has to open a ticket with the Performance team to get the instance un-wedged.