Discovery probes and sensors
perform data collection and processing tasks.
You can also use patterns for the identification
discovery. Probes and sensors are always used for the scanning phase, which uses the Shazzam
probe, and the classification stage, which uses various probes, such as the SNMP, Windows, and
Linux probes. See Patterns and horizontal discovery
The probe collects the information and the sensor processes it. Both get their instructions
from the ECC queue. There is a worker job on the MID Server that monitors the queue for work. The
monitor checks for any entries where the Queue
The MID Server then processes all the output ECC messages, runs the necessary probes, and
returns the probes results to the ECC queue. These results are put in the ECC Queue as
After an entry is inserted in the ECC Queue table, a business rule fires (on insert) that takes
that information and runs it through a sensor processor. The sensor processor's
job is to take the input data, find any sensors interested in that data, and pass it along to be
processed. Those sensors ultimately update the CMDB.
How probes and sensors work together
Probes are launched by the MID Server to collect information about a device. The probe sends
back information to the sensor to be processed.
If the probe has a post-processing script defined, the post-processing script does some data
processing on the MID Server before data is sent back to the sensor on the ServiceNow instance.
Otherwise the probes sends back all the data collected and the sensor performs this data
processing. In both cases, the sensor updates the CMDB.
A MultiProbe is a probe that contains probes. A MultiSensor processes the data from a
MultiProbe. To process the data from the MultiProbe, the MultiSensor contains individual scripts
to process the data returned by each probe contained in the Multiprobe, as well as a main
MultiSensor script. The individual scripts pass their processed data to the main MultiSensor
Probe and sensor versions
Probes and sensors have a major and a minor version.
A major version change reflects a change in the expected output of a probe, such as the
addition or subtraction of a targeted attribute, a format change, such as XML versus JSON, or a
probe parameter script change. A minor version change reflects small fixes that do not impact
the result or the processing of the data. All members of a MultiProbe bundle have the same major
and minor version.
A sensor and its corresponding probe must have the same major version. It is recommended they
also have the same minor version. This version matching ensures that the data sent back from the
probe is understood and properly processed by the sensor.
You can set the Warn on Minor Version Mismatch system property if you
want to generate a warning message when the minor versions do not match. These warnings appear
in the discovery log file but do not show up on the Discovery Dashboard.
Versions for MultiProbe and MultiSensors are checked as follows:
- The versions of the individual probes contained in the MultiProbes are compared with the
Responds to Probes scripts that process their data.
- The versions of the Responds to Probes scripts and the main MultiSensor script are
If a probe and its corresponding sensor do not have the same major version, a sensor does
not process information during a discovery and sends error messages to the log file. Errors also
show up on the Discovery Dashboard when you run a discovery job. If the major version is the
same, but the minor version is not, a sensor processes information during a discovery.