--- sourceDocument: Xanadu IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/it-operations-management Release : - xanadu ft:locale : - en-US ft:publication_title : - Xanadu IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Agent Client Collector for Visibility - Content default checks and policies # Agent Client Collector for Visibility - Content default checks and policies {#ariaid-title1} * Release version: Xanadu * * Updated August 1, 2024 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Agent Client Collector for Visibility - Content (ACC-VC) provides various checks and policies as well as a business rule. ## Policies {#acc-visibility-checks-policies__section_zvl_lfz_z4b} Note: ACC-VC policies execute at a frequency of once per day. The total data ingested would be approximately 572KB prior to file-based discovery, which runs once per week. This takes into consideration an average of approximately 1500 installed software applications and approximately 500 running processes other than CI data per machine. Enhanced Discovery Policy : Runs off a schedule, which is defaulted to 24 hours (86400 seconds). The policy interval can be adjusted, for example to run every 4 hours (set the interval to 14400). The ACC-V policy configuration is synced to all agents based on the policy filter defined by ACC-V. Update the following ACC-F system properties if needed: * \[sn_agent.disco_minimum_threshold_for_rediscovery_minutes\]: to avoid discovering the system too frequently. * \[sn_agent.disco_disable_ci_clobber_of_agentless_disco\]: to avoid Discovery conflicts. * \[sn_agent.disco_ci_clobber_of_agentless_disco_threshold_days\]: to avoid Discovery conflicts. {#acc-visibility-checks-policies__ul_pgt_ln4_vrb} SAM Discovery policy : Responsible for capturing the software installed on any Windows endpoint device, such as desktops or servers. SAM background policy : Enables a background job for processing the Osqueryd logs for SAM on Windows and macOS endpoint devices. SAM background policy (Non OsqueryD) : Enables a background job to collect SAM information using osqueryi instead of osqueryd. Software installed policy : Responsible for capturing the software installed on all Linux devices and instance CIs. The data collected is stored in the \[cmdb_sam_sw_install\] table. The software installed policy is scheduled to run every 24 hours. Note: Windows endpoint devices include devices that have a Windows operating system and belong to CI class: computer. See [System properties](https://www.servicenow.com/docs/access?context=r_AvailableSystemProperties&version=xanadu&pubname=xanadu-platform-administration&ft:locale=en-US) for more details. For more details on policies, see [Checks and policies](https://www.servicenow.com/docs/F0COo~NAOjYK~CKffe4bKA "A check is a combination of a command and its configuration. The check is executed on the Agent Client Collector's devices to gather data from those devices."). ## Check type {#acc-visibility-checks-policies__section_i2j_dzz_1pb} ACC-VC has the following check types: Enhanced Discovery, SAM Advanced Discovery, and Installed Software. Enhanced Discovery : This check type is responsible for invoking the EnhancedDiscoveryHandler script include that processes the payload produced by endpoint_discovery.rb as executed by ACC. SAM Advanced Discovery : This check type is for the Windows SAM Discovery policy that invokes the EnhancedDiscoveryHandler script include for processing the SAM data produced by the sam_advanced.rb file. Installed Software : This check type for the Software installed policy that invokes the EnhancedDiscoveryHandler script include for processing the installed software data produced by the installed_software.rb file. ## Check definitions {#acc-visibility-checks-policies__section_lck_mfz_z4b} There are four Check definitions which are used by the four ACC-V Policies. Enhanced Discovery : This policy configuration is synced to all agents based on the policy filter defined by ACC-V. The Check definition is configured to run with certain assets and determines what gets synced between the Agent and the MID Server. For more detail on policies, see [Checks and policies](https://www.servicenow.com/docs/F0COo~NAOjYK~CKffe4bKA "A check is a combination of a command and its configuration. The check is executed on the Agent Client Collector's devices to gather data from those devices."). Note: For the Agent to retrieve the OS serial numbers and TCP connections along with associated running processes, sudo access for "dmidecode" and "ss" is required on Linux systems. For example, this content could be added to /etc/sudoers or to an individual file in /etc/sudoers.d/: Cmnd_Alias AGENT_ACC_V = /usr/sbin/dmidecode -s baseboard-serial-number,/usr/sbin/dmidecode -s chassis-serial-number,/usr/sbin/dmidecode -s system-serial-number,/usr/sbin/dmidecode -s system-uuid,/usr/sbin/ss -tanp servicenow ALL=(root) NOPASSWD:AGENT_ACC_V SAM background log check : The check definition log runs every 8 minutes and performs inline aggregation of data generated from Osqueryd logs. After collecting the data, it writes all the intermediate data results into a temporary marker file which is reused in the next run. This reuse limits the number of log files and disk space needed on target systems. Note: You may notice a spike in system resource consumption as the background aggregation check runs every interval. Software installations and usage metrics : This check definition collects the data every 24 hours. Installed software : This check definition fetches installed software data for all devices other than Windows and macOS endpoint devices. ## Business rule {#acc-visibility-checks-policies__section_iwf_chz_z4b} The Enhanced Discovery -- On Host CI Delete business rule triggers the Endpoint Discovery Check when the CI associated with a given CI is deleted from sn_agent_cmdb_ci_agent.