Logs for Discovery

The Discovery log and Pattern Discovery/Horizontal Discovery log display the activity that takes place during a discovery. Use the logs to debug failed discoveries.

Discovery Log

The Discovery Log shows information such as classification failures, CMDB updates, and authentication failures. A Discovery Log record is created for each action associated with a discovery status.

Figure 1. Discovery Log Records

Pattern Discovery and Horizontal Discovery log

The Pattern Discovery log includes Horizontal Discovery log records, which display information about discoveries that were performed with patterns. A horizontal discovery log record is created for an entire horizontal discovery run, which includes the results of all the operations specified in the pattern.

Figure 2. The Horizontal Discovery log
Horizontal Discovery log

Open the Discovery Log

Open the Discovery Log to troubleshoot a discovery.

Before you begin

Role required: discovery_admin

Procedure

  1. Navigate to Discovery > Status.
  2. Open a Discovery Status record.
    Log entries appear in the Discovery Log related list.
    Figure 3. Discovery Log Records
    The Discovery Log provides the following information:
    Field Input value
    Created Timestamp of the Discovery activity. Each timestamp defines the approximate time of the activity. Several Discovery events may occur in random order within a second.
    Level Classifies the activity into one of the following levels for general sorting:
    • Error
    • Information
    • Warning
    Short Message Informative message detailing the outcome of the activity or the Discovery progress. Look here for the result of a classify probe or for authentication failure.
    ECC queue input The related input record from the ECC queue for this discovery. You can also view these records from the ECC Queue related list.
    CI Names a device for which a matching CI was found in the CMDB. Click this link to drill down into the CI record for the device.
    Source Names the particular activity, such as the Shazzam probe or a UNIX classify probe.
    Device Lists the IP address of the CI discovered. All devices identified by IP address appear in the log, even if they refused all invitations to communicate. Any port activity from a device places it into the log, even if all subsequent efforts to identify it fail. Click the IP address of the device to view the events associated with discovering that device.
  3. Do any of the following:
    • Click a link in the CI column to open the record for that CI.
    • Click the link in the Created column to view the log record.
    • Click the IP address link in the Device column to view the log records for a particular device.
    Note: The Discovery log also displays errors that occur during identification by taking log entries from the Identification Engine Log. See Examine identification engine run logs for more information about the identification engine and possible errors.

Open the Pattern Discovery Log

Open the Pattern Discovery Log to troubleshoot a discovery with patterns.

Before you begin

Role required: discovery_admin

Procedure

  1. Navigate to Pattern Designer > Discovery Pattern Log.
  2. Sort the list of pattern log entries by any column, such as Pattern or Status.
  3. Click the View Log link in the Log message column for the desired log record.
    The Horizontal Discovery Log window opens.
    Figure 4. The Horizontal Discovery log
    Horizontal Discovery log
    Discovery Log Item Description
    Pre Pattern Execution The actions that were run before the pattern was launched.
    Selecting Pattern for Execution The pattern that was run for discovery.
    {Identification Section name} Displays the results of the operations in the pattern. Expand the name to see each operation.
    Pre Payload Processing Scripts The results of scripts that were run before the payload was received.
    Payload Processing Details about the payload and how it was processed. Look in this section to find errors that might have been encountered during various activities, such as the running of identification rules, updates to the CMDB, and so on.
    Post Payload Processing Scripts The results of scripts that were run after the payload was received.
  4. Click an item in the left-hand column to see more information about it in the right-hand column.
  5. To debug the pattern, click the name of the Identification Section, and then click the Debug button in the upper-right.
  6. To return to the log record, click the X in the upper-right.

Change Discovery log retention time

You can configure the amount of time that Discovery retains log entries.

Before you begin

Role required: admin

About this task

By default, the Discovery log retains information for 30 days, or 2,592,000 seconds.

Procedure

  1. Open the Auto Flushes table by typing sys_auto_flush.list in the navigation filter.
  2. Open the discovery_status record.
  3. Change the value in the Age in seconds field.
  4. For the change to take effect immediately, run the Table Cleaner Job in the Schedule [sys_trigger] table.
  5. Click Update.