Linux discovery

  • Release version: Zurich
  • Updated March 31, 2026
  • 6 minutes to read
  • Discovery and Service Mapping applications use probes and patterns to discover and map information about Linux computers and servers. The information is populated in the CMDB. Discovering some of these resources may require updating to the latest version of the Discovery and Service Mapping Patterns application from the ServiceNow Store.

    Supportability details

    The Linux server pattern can discover only English-based Linux.

    Supported Linux operating systems
    For IPv4 discovery:
    • Red Hat
    • Oracle
    • Fedora
    • Debian
    • SUSE
    • CentOS
    • Ubuntu
    • Alpine Linux (starting from Visibility Content version 6.30.0)*
    * Operating System and OS Version only
    For IPv6 discovery:
    • CentOS 7
    • Ubuntu 20
    The following operating systems or devices haven’t been verified for IPv6 discovery:
    • Red Hat cluster
    • Oracle Clusterware
    • Linux Pacemaker cluster
    • Network storage

    Classifier, probes, and pattern

    Classifier Probes Pattern
    Linux

    (Unix classification)

    • Horizontal discovery probe: Launches patterns
    • Linux - Installed Software^
    • Unix - ADM^
    • Linux - Identity*
    • Linux - CPU*
    • Linux - Distribution*
    • Linux - Find FQDN*
    • Linux - Memory*
    • Linux - Memory Modules*
    • Linux - Network ARP Tables*
    • Linux - Storage*
    • Linux - Amazon EC2*
    • Unix - OS Uptime*
    • UNIX - OS Filesystems*
    • UNIX - Find FQDN*
    • Unix - ADM Enhanced*
    Linux Server

    *These probes aren't active on the classifier, as Discovery uses patterns by default for these discoveries.

    ^These probes remain active by default, even when Discovery uses pattern discovery.

    To use patterns, verify that the correct pattern is specified in the horizontal pattern probe on the classifier. See Add the Horizontal Pattern probe to a classifier for instructions.

    Request new or enhanced Patterns on the ServiceNow® Store

    Visit the ServiceNow Store to view all the available updates and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.

    Requirements for Linux discovery

    Before running a discovery, you must verify that all the required configurations are complete.
    Verify the plugins installation and activation
    Verify the required credentials configuration

    Configure the credentials by the required SSH permissions. Discovering sensitive Linux data may require a user with appropriate sudo privileges to run the sudo commands. To configure the required sudo privileges, modify the /etc/sudoers file to include the commands that Discovery needs. For /etc/sudoers line examples for each command, see SSH commands requiring a privileged user during probe-based discovery.

    For more information about the commands that require a user with elevated rights, refer to the following documents.

    SSH private key credentials are preferable over SSH password credentials for security reasons.

    Verify the MID Server configuration
    For detailed information, see:
    Verify the configuration of the discovery schedule

    For information on creating a discovery schedule, see Schedule a horizontal discovery.

    Defining IP ranges ensures that only the specified network adapters and their primary IP addresses are used during Linux discovery. You can configure Quick Ranges by entering comma-separated IPv4 address ranges or single IPv6 address.

    Alternatively, you can use the network_adapter_exclusion_list property to limit Linux discovery to specific network adapters and their primary IP addresses. For more information, see Omit network adapter secondary IP addresses in Linux discovery.

    (Optional) Populate Virtual Machine Object field in Hardware [cmdb_ci_hardware] table
    Starting with Discovery and Service Mapping Patterns version 1.30.2, you can improve query performance by populating the Virtual Machine Object field in the Hardware [cmdb_ci_hardware] table. For more information, see Improved query performance with direct field population in CI tables.

    Data collected

    The Linux classifier triggers probes that perform the discovery. Several probes are launched during the discovery. See the classifier for a list of the trigger probes.
    Note:
    See the knowledge article KB0687582 for information on model_id and manufacturer.
    Label Table Name Field Name Source
    Operating System cmdb_ci_linux_server os uname -a
    OS Version cmdb_ci_computer os_version uname -a or cat /etc/*release
    Short description cmdb_ci_linux_server short_description uname -a
    Name cmdb_ci_linux_server name DNS, NBT
    Hostname cmdb_ci_linux_server host_name DNS, NBT
    DNS domain cmdb_ci_linux_server dns_domain DNS
    Start date cmdb_ci_linux_server start_date uptime
    Manufacturer cmdb_ci_computer manufacturer dmidecode
    Serial number cmdb_ci_computer serial_number dmidecode
    CPU type cmdb_ci_linux_server cpu_type /proc/cpuinfo
    CPU speed (MHz) cmdb_ci_linux_server cpu_speed /proc/cpuinfo
    CPU count cmdb_ci_linux_server cpu_count /proc/cpuinfo
    CPU core count cmdb_ci_computer cpu_core_count /proc/cpuinfo
    CPU core thread cmdb_ci_computer cpu_core_thread /proc/cpuinfo
    CPU manufacturer cmdb_ci_linux_server cpu_manufacturer /proc/cpuinfo
    Model number cmdb_ci_computer model_number dmidecode
    Model ID cmdb_ci_computer model_id dmidecode
    RAM (MB) cmdb_ci_linux_server ram meminfo
    Disk space (GB)* cmdb_ci_linux_server disk_space /proc/ide, /proc/scsi, /var/log/dmesg
    Type cmdb_ci_disk type /proc/ide, /proc/scsi, /var/log/dmesg
    Model ID cmdb_ci_disk model_id /proc/ide, /proc/scsi, /var/log/dmesg
    Disk space (GB) cmdb_ci_disk disk_space /proc/ide, /proc/scsi, /var/log/dmesg
    Name cmdb_ci_disk name /proc/ide, /proc/scsi, /var/log/dmesg
    Name cmdb_ci_file_system name df
    Capacity (MB) cmdb_ci_file_system capacity df
    Free Space Bytes (MB) cmdb_ci_file_system free_space_bytes df
    Mount point cmdb_ci_file_system mount_point df
    Name cmdb_running_process name ps
    Command cmdb_running_process command ps
    Type cmdb_running_process type ps
    PID cmdb_running_process pid ps
    Parameters cmdb_running_process parameters ps
    Name cmdb_ci_network_adapter name ifconfig or ip address show
    IP address** cmdb_ci_network_adapter ip_address ifconfig or ip address show
    MAC address cmdb_ci_network_adapter mac_address ifconfig or ip address show
    Netmask cmdb_ci_network_adapter netmask ifconfig or ip address show
    Default gateway cmdb_ci_hardware default_gateway route
    * The value in the disk_space field is an aggregation of the total capacity (to include used space) for all non-removable disks, including both directly attached and SAN storage.
    Note:
    Make sure to define unique serial numbers for the RAMs on the Linux server.

    Discovery also identifies and classifies information about Linux KVM. Discovery identifies Linux kernel-based virtual machines (KVM) when the process classifier detects libvirtd running on a Linux server. The classification triggers the creation of a cmdb_ci_kvm record and launches the SSH Command probes to explore the Linux server with virsh, lbvert utility, and virtual machine configuration data.

    Discovery creates a [cmdb_ci_kvm_instance] record for each virtual machine on the server, and then matches the [cmdb_ci_kvm_instance] record to a corresponding [cmdb_ci_computer] record using the MAC addresses of installed network adapters.

    Table 1. Tables used by Discovery on Linux KVM
    Table name Extends Description Source
    cmdb_ci_kvm cmdb_ci_vm A hypervisor that manages kernel-based virtual machines (KVMs) Process classifier detects libvirtd running on Linux servers
    cmdb_ci_kvm_vm_instance cmdb_ci_vm_instance A virtual machine instance on this hypervisor virsh list-all and dumpxml command
    cmdb_ci_kvm_object cmdb_ci_vm_object An object connected to a virtual machine instance <network>, <storage pool>, and <storage volume> elements from the dumpxml command
    cmdb_kvm_device Not applicable A device connected to a virtual machine instance <devices> element from the dumpxml command
    Table 2. Data collected by Discovery on Linux KVM
    Label Table name Field name Source
    Linux Host cmdb_ci_kvm linux_host Reference to the cmdb_ci_linux_server that is running this virtual machine
    Details cmdb_ci_kvm details_xml dumpxml
    Object ID cmdb_ci_kvm_vm_instance object_id virsh dumpxml
    State cmdb_ci_kvm_vm_instance state virsh list-all
    CPUs cmdb_ci_kvm_vm_instance cpus virsh dumpxml
    Memory cmdb_ci_kvm_vm_instance memory virsh dumpxml
    Disks cmdb_ci_kvm_vm_instance disks virsh dumpxml
    Disks size cmdb_ci_kvm_vm_instance disks_size virsh domblkinfo
    Network adapters cmdb_ci_kvm_vm_instance nics virsh dumpxml
    Name cmdb_ci_kvm_vm_instance name virsh dumpxml
    Short description cmdb_ci_kvm_vm_instance short_description virsh desc
    Details cmdb_ci_kvm_object details_xml XML element from dumpxml
    KVM instance cmdb_kvm_device kvm_instance Reference to cmdb_ci_kvm_instance
    Device cmdb_kvm_device device disk, controller, interface, and so on
    Type cmdb_kvm_device type depends on the device
    Details cmdb_kvm_device details_xml XML element from dumpxml
    Table 3. Data collected by Discovery on KVM Relationship
    Relationship Parent table Child table
    Registered On::Has Registered KVM [cmdb_ci_kvm] KVM Virtual Machine instance [cmdb_ci_kvm_vm_instance]
    Provided By::Provides KVM [cmdb_ci_kvm] Network [cmdb_ci_kvm_network]
    Defines resource for::Gets resources from KVM [cmdb_ci_kvm] Storage Pool [cmdb_ci_kvm_storage_pool]
    Connected By::Connects KVM Virtual Machine instance [cmdb_ci_kvm_vm_instance] Network [cmdb_ci_kvm_network]
    Instantiated By::Instantiates KVM Virtual Machine instance [cmdb_ci_kvm_vm_instance] Computer [cmdb_ci_computer]
    Virtualized By::Virtualizes Computer [cmdb_ci_computer] KVM [cmdb_ci_kvm]
    Provides storage for::Stored on Storage Pool [cmdb_ci_kvm_storage_pool] KVM Virtual Machine instance [cmdb_ci_kvm_vm_instance]