The MID Server ECC queue

The External Communication Channel (ECC) Queue is a connection point between an instance and the MID Server. Jobs that the MID Server needs to perform are saved in this queue until the MID Server is ready to handle them.

The MID Server subscribes to messages published by the Asynchronous Message Bus (AMB), which notifies the MID Server that it has pending tasks in the ECC queue. If a job exists in the ECC Queue for that MID Server, the MID Server sets the status to "I'm working on it." When finished working on a requested job, the MID Server reports back to the ECC queue with the results.

Access the ECC queue

Open ECC queue records to see details of the details of a discovery. You can view ECC queue records while a discovery is in process.

Before you begin

Role required: admin

Procedure

  1. Navigate to one of the following:
    • Discovery > Output and Artifacts > ECC Queue
    • Discovery > Discovery Schedules > {schedule name} > {Discovery status record}
    • ECC > Queue
    • {Discovery Status record} > ECC Queue
  2. Sort the list by any column that interests you, such as Created or Queue.
  3. Open an ECC queue record (see table for field descriptions).
    Table 1. ECC queue fields
    Field Input value
    Agent The name of the external system that this messages is either from or to. If the message is from or to a MID Server, the agent name is in the form mid.server.xxx, where xxx is the name of a particular MID Server.
    Topic The name of the probe the MID server ran. If you are using a pattern for discovery, HorizontalDiscoveryProbe appears.
    Name The actual command the probe ran. For example, if Topic is SSHCommand, then the Name field contains the actual shell command to run. If you are using a pattern for discovery, the following appears:

    Pattern Launcher: followed by the name of the pattern and the multipage number.

    Source The IP address that the discovery is to run against. A few probes run against multiple IP addresses; in those cases, this field contains a human-readable description.
    Response to This optional field contains a reference (sys_id) to the ECC Queue message that this message is in response to. Discovery makes extensive use of this field to track the hierarchy of messages that result from a given scheduled Discovery. Click the record icon for the value in this field to open the ECC Queue record for the activity that spawned the current probe or sensor record.
    Queue An indicator of whether this message was is an input message or an output message.
    State The state of the current ECC queue record. States update automatically. See The ECC queue for Discovery for a brief overview of the process flow.
    Processed The time when this message was processed.
    Created The time when this message was created.
    Sequence The unique sequence number for this message. This value is automatically generated when an ECC Queue record is inserted. Its use is deprecated.
    Error string An error message, if an error occurred during processing. This field is hidden on the standard form unless there was an error.
    Payload The body of the message in XML format. The returned XML has a root tag of <results> containing one or more <result> tags and a single <parameters> tag. The parameters are simply an echo of those sent to the MID server in the probe; they vary from probe to probe, but in general they tell the probe the details of what it is to do and how it should behave. The result tags are the most interesting ones: they contain the actual data generated by the probe.
  4. Click any of these related links:
    Related link Description
    Run again Runs the probe again. You can re-run probes when you encounter a failed discovery or other unexpected results.
    Go to CMDB item Open the CI record for the CI that was updated during the discovery.
    Go to Sensor Open the record for the associated sensor.

Create an ECC Queue message

One of the capabilities of the MID Server is to be able to send remote commands through the MID Server to the hosting device, and then gather the response.

About this task

This feature enables an administrator to issue remote commands directly from the ECC Queue without running Discovery.

Procedure

  1. Navigate to Discovery > Outputs and Artifacts > ECC Queue.
  2. Click New.
  3. Create a message with the following settings:
    • Agent: The name of the MID Server that executes the command
    • Topic: Command
    • Name: The actual command that you want to process. For Windows, this is expressed in a DOS command line structure. For Linux, the structure could be a bash command line entry.
    • Queue: Output
    • Payload: With proper XML tags, you can specify the command here instead of in the Name field. The advantage to this is that the command is not restricted by the Name field length of 120 characters. Use the following XML format for the command:
    <parameters>
         <parameter name="name" value="ACTUAL_COMMAND_LINE"/>
    </parameters>

Result

The MID Server takes the XML entry in the ECC Queue and processes the command-line call locally. The STDOUT is returned to the ECC Queue as an Input queue entry.
Note: The command specified through the Payload field takes precedence over the command specified in the Name field.

Access MID Server log entries from the ECC queue

You can access entries in the ECC Queue that show agent0.log.0 logs and wrapper.log logs for an individual MID Server.

Before you begin

Role required: admin or mid_user

About this task

After you install and configure your MID Servers, there are several tasks you can perform to monitor the MID server, including viewing the logs to find warnings and errors.

Procedure

  1. Open a MID Server record.
  2. Under Related Links, click Grab MID Logs.
    ECC queue records appear in the list using the following filter:
    • Topic is SystemCommand
    • Source is grabLog
    • Agent is {your MID Server}

    Only agent0.log.0 and wrapper.log entries appear. These logs are also accessible in the ~\agent\logs\ file path.

  3. To open a log entry, click the link under the Created column.

View MID Server statistics

You can access entries in the ECC Queue that belong to the queue.stats topic for an individual MID Server. Use these statistics for monitoring and troubleshooting your MID Server.

Before you begin

Role required: admin or mid_user

About this task

Useful MID Server statistics include memory and CPU usage data.

Procedure

  1. Open a MID Server record.
  2. Under Related Links, click MID Statistics.
    ECC queue records appear in the list using the following filter:
    • Topic is queue.stats
    • Agent is {your MID Server}