Discovery probes

Probes are launched by the MID Server to collect all the information that you want returned from a device.

For example, the base instance has probes to get the names of Windows andLinux devices, and separate exploration probes that return disk information for devices with those operating systems. View each probe's results in the ECC queue, which displays specifics such as the time the probe ran and its payload. For each probe, you must also create a sensor to process the data that the probe returns.

The following are examples probes and their type:

Table 1. Discovery Probe Types
Device Probe Type
Windows computers and servers Remote WMI queries, shell commands
UNIX and Linux servers Shell command (via SSH protocol, version 2). Discovery supports any Bourne-compatible shell. For configuration instructions, see MID Server parameters.
Storage CIM/WBEM queries
Printers SNMP queries
Network gear (switches, routers, etc.) SNMP queries
Web servers HTTP header examination
Uninterruptible Power Supplies (UPS) SNMP queries

The Probe form

To view existing probes, navigate to Discovery > Discovery Definition > Probes. The Probe form provides the following unique fields.
Table 2. Probes Fields Table
Field Description
Probe type Select the probe for the operating system of the device it will query.
  • CIM Probe: Select this probe type to query a CIM server using WBEM protocols.
  • Multiprobe: Select this probe type to run one or more simple probes of any type or mix probes of different types. This type of probe can make several queries simultaneously that return all the results at the same time. You cannot add multiprobes to other multiprobes.
  • Probe: Select this generic probe type to define a probe class. Specify the name of the probe class in the ECC queue topic field.
  • SNMP Probe: Select this probe type for network devices, such as routers.
  • WMIRunner Probe: Select this probe type for Windows devices.
ECC queue topic Enter a descriptive term for the function of the probe. The probe uses this label as the Topic field for incoming ECC queue messages. The term does not have to be unique. For example, all the UNIX probes might have an ECC queue topic value of SSHCommand.
By default, ServiceNow probes use the following ECC queue topics:
ECC queue name Enter either a descriptive name for human use, or the actual command the probe is to run. For example, if the value in the ECC queue topic field is SSHCommand, then enter the actual shell command to run in this field.
Cache Results Select this option to cache this probe's results in the probe results cache.
Classic Mode Select this option to cache this probe's results in the Starting in Fuji, select this option to debug the post-processing script on the ServiceNow instance instead of the MID Server. This mode is only valid if a post-processor script exists. Use the Classic mode to debug post-processing scripts in the test environment. ServiceNow does not recommend use of the Classic mode in the production environment.
Post processor script Starting in Fuji, defines a post-processing script that runs on the MID Server. The script accepts probe results as an input and outputs a JSON string that is sent back to the ServiceNow instance for a sensor to use as input.