The ECC queue for Discovery

The External Communication Channel (ECC) Queue is a connection point between an instance and other systems that integrate with it, most commonly a MID Server.

You can drill down in the ECC Queue from the beginning to the end of the Discovery, or drop into the sequence of probes and sensors at any point. To open the ECC Queue, open a Discovery Status record, and then select ECC Queue from the Related Links. You can sort the list by the timestamp or select any probe or sensor record that interests you. You can see what activity launched the probe or answered the sensor's commands and track the processing order for a Discovery in either direction. To determine whether a record is for a probe or a sensor, look at the value in the Queue column. Sensor records are in the input queue, and probe records are in the output queue.

This view of the ECC Queue is the best way to see the Shazzam and Ping probes without extensive drilling. Ping probes can be chunked up to reduce the delay in returning results. The chunking of Ping probes is controlled by a property in Discovery Definition > Properties called Max ping chunk size. This property is described as the maximum number of IPs that will be pinged in one "chunk" of work. If a Discovery range has more than this number of IPs in it, it will be automatically broken up into chunks no larger than this parameter's value.

Automatic deletion of ECC queue records

If Discovery is running on an instance, the size of this table can grow to several gigabytes. Most of the accumulated data is unnecessary, but some entries might be important for troubleshooting any problems with Discovery. For example, if Discovery is not properly capturing the disk drives on a particular Windows server, look in the ECC Queue at the data returned by the Windows - System Information probe. The best practice is to retain ECC Queue data from Discovery for at least a month.

By default, records in the ECC Queue older than 7 days are deleted automatically. You can set the deletion schedule by updating the table rotation schedule for the ECC queue. The table rotation names are:
  • ecc_queue_event
  • ecc_queue

Probe and sensor activity

The ECC Queue provides you with a connected flow of probe and sensor activity. The position of records in the list is dependent on your sorting criteria and might not represent the processing order of the Discovery. Activity is recorded (Created date) when the probe is launched or the sensor records the response in the instance. On a busy system, sensor input might be queued in the instance and delayed from being recorded. Sensors can launch multiple probes that require different intervals to respond. A probe record displays the instructions it was given when it was launched, and the sensor record shows the probe instructions and the results of the probe. All this information is checked into the instance.

To track the processing sequence, use the following methods:
  • To track the flow of probes and sensors deeper into the Discovery (toward completion), drill down using the Queue Related List at the bottom of the ECC Queue record. This list displays the next activity in the Discovery, by either a probe or a sensor. If the Queue list is empty, then that branch of the Discovery is complete. Multiple entries means that the sensor in the current record launched multiple probes.
  • To track backwards toward the beginning of the Discovery, drill down using the Related Field icon in the Response to field. This action opens the ECC Queue record for the activity that spawned the current probe or sensor record.

ECC queue fields

An ECC Queue record provides the following fields:

Table 1. ECC queue fields
Field Input value
Agent The name of the MID Server that initiated the probe.
Topic Type of probe or sensor that was active (SSH, WMI, or SNMP).
Name Identifying name of the probe or sensor. For SSH probes, this is the probe's message. For all others, the name is an identifying string generated by the instance.
Source The IP address of the Discovered device. The Shazzam and Ping probes do not have a source IP associated with them. These probes are not directed toward a single device, but exist to scan all devices in the specified network range.
Response to Displays the name of the probe or sensor in the Discovery sequence whose activity triggered this probe or sensor. A single sensor can launch several probes, but a sensor can only respond to a single probe.
Queue Designates whether the record is for a probe or a sensor. Sensors are in the input queue, and probes are in the output queue.
State Shows where the probe or sensor is in the process of completing its task (e.g. processed or processing)
Processed Times that this probe or sensor's task was finished.
Created Time that this probe or sensor was launched/activated.
Sequence Internal ID for the execution sequence for this probe or sensor.
Payload Contents of the probe's instructions or the response that the sensor reports to the instance. Click the XML button to display the code in an XML view.

An ECC Queue record for Discovery looks like this:

Figure 1. Discovery ECC queue

Viewing CMDB records

As you drill down through the probes and sensors that are part of a Discovery, you can view the CMDB record for the device (CI) that was probed, using either of the following methods:
  • Right-click a probe or sensor in the ECC Queue record list and select Go to CMDB item.
  • In a ECC Queue record, click the Go to CMDB item Related Link.


If you are suspicious of the results of a Discovery (credential failure, for example), you can run individual probes directly. To run a probe from the ECC Queue list, right-click the probe and select Run Again from the pop-up menu. To run a probe directly from an ECC Queue record, click the Run Again UI action in Related Links.