Thank you for your feedback.
Form temporarily unavailable. Please try again or contact to submit your comments.
  • Madrid
  • London
  • Kingston
  • Jakarta
  • Istanbul
  • Helsinki
  • Geneva
  • Store

The ECC queue for Discovery

Log in to subscribe to topics and get notified when content changes.

The ECC queue for Discovery

The External Communication Channel (ECC) Queue is a connection point between an instance and other systems that integrate with it, most commonly a MID Server.

Contents of the ECC Queue

The ECC queue contains records that are created during all stages of discovery. Each record is essentially a message from the instance and another system, classified as output, or a message from the external system to the instance, classified as input. ECC queue records provide you with a connected flow of probe and sensor activity, as well as the actual XML payload that is sent to or from an instance.

The following image is an example of a record in the ECC queue. This record shows that a WMI classifier probe was instructed to run and has been processed. See The MID Server ECC queue for a description of each field.

Automatic deletion of ECC queue records

If Discovery is running on an instance, the size of this table can grow to several gigabytes. Most of the accumulated data is unnecessary, but some entries might be important for troubleshooting any problems with Discovery. For example, if Discovery is not properly capturing the disk drives on a particular Windows server, look in the ECC Queue at the data returned by the Windows - System Information probe. You should retain ECC Queue data from Discovery for at least a month.

By default, records in the ECC Queue older than 7 days are deleted automatically. You can set the deletion schedule by updating the table rotation schedule for the ECC queue. The table rotation names are:
  • ecc_queue_event
  • ecc_queue
You can access the ECC queue from either of these locations:
  • Discovery > Output and Artifacts > ECC Queue
  • ECC > Queue
Figure 1. An example ECC queue record
An example ECC Queue

ECC queue states

Input and output messages keep processing in turn until the discovery is finished or terminated. You can monitor the ECC queue to see records populate during discovery, and see the states of each record change. The process is as follows:
  1. When new probe instructions are available for the MID Server, the system creates an output record with the state of ready.
  2. The MID Server then starts processing the probe instructions and the state changes to processing before it finally changes to processed.
  3. When a result returns to the MID Server and is ready to be sent to the instance, the system creates an input record with the state of ready.
  4. While the system processes the payload, the state changes to processing before it finally changes to processed.

    If any errors are encountered, the state changes to error. You can look for errors to troubleshoot failed discovery.

Properties and parameters that affect the ECC queue

These properties are available to control aspects of the ECC queue:
Property Description
Save ECC queue attachments The normal behavior for discovery sensors is to delete attachments to ECC queue entries upon successful sensor processing. Enabling this property overrides this behavior, and forces attachments to be preserved. This would normally only be useful for debugging purposes.

Location: Navigate to Discovery Definition > Properties to enable the property.