A classifier is a set of rules that identifies a device type based on the results of a probe. A classifier can have one or more related lists that define the classification criteria, the pattern probes, and the triggers probes. The pattern probes related list specifies which horizontal discovery pattern to run for the device type. The triggers probes related list specifies which probes to run after the device is classified, and before the horizontal discovery pattern is executed.  The triggers probes can be used to gather additional information or credentials that are needed for the horizontal discovery pattern 1 2 .

The Discovery pattern log is a log that records the execution of a pattern during Discovery or Service Mapping 1 .  It shows the success or failure of the individual pattern steps, as well as the input and output variables, the CI attributes and relationships, and the errors or warnings 2 .  The ECC Queue is a table that displays the input and output messages from and to MID Servers 3 .  It shows the payload of CI attributes and relationships, the Shazzam probe payload, and the relationships created, but not the success or failure of the individual pattern steps 4 .  The success or failure of the individual pattern steps is specific to the Discovery pattern log and can be used to debug or troubleshoot the pattern execution 2 .

The MID Server parameters like 'mid.ssh.session_timeout', 'url', and 'mid.windows.management_protocol' can be modified through the ServiceNow platform UI under the MID Server configuration settings. These parameters control various aspects of the MID Server's operation, such as timeout settings for SSH sessions, the URL for the MID Server to communicate with the ServiceNow instance, and the management protocol to use for Windows servers, respectively. The 'name' of the MID Server, however, is not typically a parameter that can be changed through the UI as it is a unique identifier for the MID Server within the ServiceNow instance. Once a MID Server is registered with a name, that name is usually persistent and not intended to be modified through configuration settings.

The SNMP Query operation on a pattern for a custom device query allows Discovery to retrieve information from the target device using the SNMP protocol. It is best practice to use the published manufacturer’s device MIB, which is the official and standard definition of the device’s SNMP data. Using the manufacturer’s device MIB ensures that the query is accurate, consistent, and compatible with the device.  Modifying the default MIB information, enabling SSH as a secondary protocol, or using live devices in production are not recommended practices, as they may introduce errors, security risks, or performance issues 1 2 3 .

 The Service Account for the MID Server must have the Log on as service right on the Windows platform. This right allows the MID Server to run as a Windows service and communicate with the ServiceNow instance. The Service Account does not need to have local or domain admin rights, as these are not required for the MID Server functionality. The MID Server User Role is a role on the ServiceNow instance, not on the Windows platform, and it is used to control the access and permissions of the MID Server on the instance.

For ServiceNow Discovery to detect a Windows device, the Windows Management Instrumentation (WMI) service needs to be running on the host. WMI is a Windows feature that provides a standardized way to access management information about operating system components and services. Discovery uses WMI to query Windows hosts for information about their hardware, software, and system configuration. SSH is used for Unix-like systems, WinRM is an alternative Windows management protocol, and CIM (Common Information Model) is a cross-platform standard; however, WMI is the primary service used for Windows device discovery.

During the Port Scan phase in ServiceNow Discovery, the warning level error "No results returned from probe" typically indicates a connectivity issue. This error often arises when a logical or physical firewall is blocking the connectivity between the MID Server and the target device. This prevents the probe from successfully scanning the ports and returning results. The other options, such as incorrect process classifier configuration, wrong credentials, or incorrect datasource precedence, would generally lead to different types of errors or issues in the discovery process. References = ServiceNow Discovery documentation, particularly the sections that deal with troubleshooting Port Scan issues and understanding common errors during Discovery phases.

London Linux Servers is a  CMDB Group with Health Group type .  A CMDB Group is a collection of configuration items (CIs) that share common characteristics or are related in some way 1 .  A Health Group is a type of CMDB Group that is used to monitor and measure the health of a specific set of CIs based on predefined rules and metrics 2 .  The image shows that London Linux Servers is selected from the CMDB Health Group List, which is a dropdown menu that displays all the Health Groups defined in the system 3 . The image also shows the Group Health tab, which displays the health scores and indicators for the selected Health Group.

File-based Discovery is a process that helps identify what software is running on your Windows and UNIX servers and devices, even if there is no registration information available. File-based Discovery is triggered in the exploration phase of normal Discovery, after the target device has been classified and identified. File-based Discovery probes execute a scan searching for specific file extensions or file names in paths that you configure. The resulting file information is returned in the probe payload. The sensor attempts to match the discovered files with installed software, using the file name, size, and version returned by the probe.

 The Shazzam probe is placed in the ECC queue as a first step in horizontal discovery.  The ECC queue is a table that stores requests and responses for communication between the MID Server and the ServiceNow instance 1 .  The Shazzam probe is a script that performs port scanning on a target host to determine what protocols are available and what classifiers to trigger 2 .  The Shazzam probe is sent from the ServiceNow instance to the MID Server, which executes it on the target host and returns the results to the ECC queue 3 .