View live CI data with Agent Client Collector

View live data for incident-related CIs through Agent Client Collector for information that can help resolve the incidents.

Before you begin

• Collecting running processes for a macOS system requires sudo privileges. If sudo privileges aren't granted, only processes run by the Agent Client Collector are collected.

  To enable sudo privileges for osqueryi, add the following strings to either the /etc/sudoers file or to an individual file in the /etc/sudoers.d directory:

  • Cmnd_Alias LIVE_CI_VIEW = /Library/Application\ Support/servicenow/agent-client-collector/osquery/bin/osqueryi
  • _servicenow ALL=(ALL) NOPASSWD:LIVE_CI_VIEW
• To enable the OSQuery executable to retrieve information on logged-in users in a Windows environment, the agent must run as a local SYSTEM account.

Verify that you have installed Agent Client Collector Framework and Service Operations Workspace on your instance.

Role required: itil

Procedure

1. Navigate to Workspaces > Service Operations Workspace.
2. Select the Lists icon ().
3. Select Incidents > All.
4. Select an incident from the list.
5. On the <name of incident> form, select the Live CI Data tab.
   The CI data is displayed in the cards described in the following table.

   Table 1. Live CI Data tab cards

   Card	Description
   Device details	General details about the CI.
   Memory Usage	Amount of memory being used by the CI.
   Top 5 running processes by CPU usage	The five CI processes using the most CPU.
   Top 5 running processes by memory usage	The five CI processes using the most memory.
   Disk Usage %	Percentage of disk space in use on the CI.
   Logged-in users	Users logged in to the CI. Whether this data is visible depends on your OS privileges. MacOS: Requires sudo privileges Windows system: Requires administrator privileges Linux: No special privileges are required

Related tasks

• View live CI data logs
• Assign a problematic CI to its incident to view live CI data