Azure and AWS Service Graph Connector - stale VMI CIs (most recent discovery >2 month)

[User697706]

We are running SG-AWS and SG-Azure(without SSM deep discovery) to discovers all standard cloud resources since July 2025. Our priority for public cloud resource focused on the Virtual Machine Instance resource created in the cmdb_ci_vm_instance table. (where all the compute resources are stored)

Recently we were brought to attention that there are a lot Virtual Machine Instance CI (50k+ stale CI since we last setup the SGC) discovered by SG-AWS and SG-Azure appears to be stale/outdated (most recent discovery date >3 months)

We also noticed that majority of these stale CIs has the same "first discovered date" and "most recent discovery date". (indicates that it was created when it first discovered but never get discovered again on the next day)

We also setup the connector in another lower instance and these stale CIs are no longer discovered by SGC.

When we enquire our cloud administrator, we realized that all these stale CIs no longer exist in cloud.

I do noticed that SGC data source send the isDeletedResource=true update to retire/terminate the CIs. However they doesn't seem to be consistently doing this for all Virtual Machine Instance CI. 

Does anyone have any insight on how SGC handle the CI lifecycle state? Or what is the standard practice on handling CI lifecycle status from Service Graph Connector?

[Michael H]

Hi Wei,

We're running into the same issue where there are a large amount of Virtual machine instances that are not correctly being set to retired when deleted in AWS, so our VMI count is overblown from reality:

96.5% Deleted
3.5% Active
But almost all of the VMI's are staying active/'installed'.

Were you able to get this issue resolved? If so, how did you do it?

Cheers

[User697706]

Hi Michael, we found the issue is caused by sys_properties (sn_aws_integ.enableOptimizedDeletion) was set to true and caused this issue. It should be remain as false to prevent the CI to be set to retired when SGC AWS VM is not reporting on it's next scheduled import.

[Will O]

I have not had success using the sn_aws_integ.enableOptimizedDeletion system property. I leave the property set to "false" and depend on the isDeleted value in the SG-AWS integration.

Based on the original post, I will also add these two system properties as being worth a look:

glide.identification_engine.ire_message_listener_skip_updating_source_last_discovered_to_now
glide.identification_engine.ire_message_listener_skip_updating_last_scan_to_now

Properties for Identification and Reconciliation • Australia ServiceNow AI Platform Capabilities • D...

Since SG-AWS and SG-Azure do not provide Last Discovered/Most Recent Discovery dates, you may want to look into these system properties and see if they provide any value. Just keep in mind, the properties apply to more than just SG-AWS and SG-Azure.