Addmi 16-discovery monitoring

Editor's Notes

• #6: The No Access is just an example – obviously you can start looking at the no response or skipped ones as well.
• #7: These are 4 good starting points for exploring the results of the Discovery Run.
• #9: Core Discovery Credentials means: Login Credentials Tab – Unix and Windows via Credential Slave Slave Management Tab – AD and Workgroup Slave (Credential slave feedback will re-direct to Login Credentials Tab) SNMP Credentials Tab – Netware and other SNMP targets The Success Rate is calculated over the last access for each endpoint, so will change as discovery is run. Where it is stated that a credential has never been used then never is the valid for the depth of DDD retained on the appliance.
• #10: In the next slides we will analyse the detailed states but here you can see GREEN – 100% success YELLOW – less than 100% success BLUE – Never Used RED – Used but never succesful
• #11: Same on the slave page
• #12: Same on the SNMP page
• #15: If this credential is expected to be used then it is possible that The endpoints have not been scanned for some time Another credential matches this endpoint and is higher up the list Unused credentials should ideally be removed to prevent clutter
• #16: This is different from the BLUE Never Used state as this credential has been selected for Discovery but has failed to establish a session on 100% of recent attempts. The root cause of a red failure state is most likely to be a credential entered wrong, or a centrally administered credential that has been locked or changed. The root cause of a blue never used state is most likely to be the ordering of the credentials in the vault such that another credential further up the list is being used.
• #17: The reason we regard the SU case as both is this. It is a success as we established a session and it worked. However it is a failure as you told the system you expected to be able to switch user to the root account on this system and that failed. This allows you to track down the systems this fails on.
• #19: See later for detailed notes on analysing from the DA page onwards
• #24: So screens out Dark Space and non Host devices like switches, printers, storage etc
• #25: Update [Normal] – The cached credential from the last scan was able to establish a session and we update the Host node. This is the expected Business As Usual case Update [Credential Search] – This means we were able to establish a session and update the Host node but had to search a number of credentials o find one that worked. If you are rolling out Atrium Discovery (or extending your scanning to new areas) then this is expected behaviour as we need to find which credentials work. During normal Business As Usual operation this may indicate that credentials are being changed in the environment where you didn’t expect them and may warrant investigation.
• #26: Access Regression [Credential Failure] – There is an existing Host node related to this endpoint but we failed to update it on the last access to the endpoint as none of our credentials could establish a session Access Regression [Other Failure] - There is an existing Host node related to this endpoint but we failed to update it on the last access to the endpoint. The session was established successfully but other failures prevented full discovery; usually this means that HostInfo or InterfaceList methods have failed and frequently that can be because of timeouts. Either due to congestion in the network, busy hosts or other transient conditions sometimes a script will time out as data is not received in timely fashion and Foundation moves on. If you find that a particular credential suffers from timeouts regularly then click through to that credential and increase it’s timeout value – note that this will increase the time that this credential waits for a response so do this with care.
• #27: Unknown Host [Credential Failure] – The endpoint looks like a Host to Discovery but have never been related to a Host node in Foundation; a number of credentials were tried but no session could be established. These may be hosts that need credentials rolling out to them or new credentials need to be added to Foundation. Unknown Host [No Credential Available] - The endpoint looks like a Host to Discovery but have never been related to a Host node in Foundation; no current credentials (Login, Windows Slave or SNMP) are valid for this endpoint. These are hosts that need new credentials to be added to Foundation.