Snapshot baselining, change tracking, and rebaselining

Snapshots in TrueSight Server Automation can be based on components or server objects.

Snapshots based on components collect information about the configuration items (defined in a component template) on the selected set of targets or target groups, and components or component groups (associated with a component template using Auto Discovery or Manual discovery jobs) using a Snapshot Job.

Snapshots based on server objects collect information about server objects on the selected set of targets or target groups by using a Snapshot Job.

You can use these Snapshot jobs to collect server inventory information as well as to track configuration changes to components or targets. The collected information is stored in the TrueSight Server Automation database.

Related topics

Creating-and-modifying-Snapshot-Jobs

Cleanup-considerations-for-snapshot

Snapshot jobs collect and organize the baselining, change tracking, and rebaselining details of configuration items or server objects from each target and component. This information helps you to record the inventory of configuration items or server objects with change tracking and control the growth of persisted data in the related snapshot tables.

Baselining

When you run a Snapshot Job for the first time, it collects all configuration items or server objects (defined by the associated component template or directly as server objects) from the targets or target groups or components or component groups. This initial set of data collected by the first run of a Snapshot Job is known as the baseline. The baseline data is further used for change tracking use cases.

Change tracking 

Any subsequent job runs followed by the initial job run of a Snapshot Job only collect configuration items or server objects whose values have changed (added, modified, or removed) on a particular target or component since the last Snapshot Job run. This incremental collection of data helps reduce the amount of data that needs to persist in the database. 

The subsequent job runs after the initial Snapshot baseline job run can also create a target or component-level baselines for a configuration item or server object in certain scenarios. For example, a new target or component-level baseline is created if a new target or component gets added to a target group or a component group, or if a component gets versioned that is being used in the actual Snapshot Job.

Important

If a Snapshot Job is based on a component, change tracking is done on the subsequent Snapshot job runs until no changes (versioning) occur in the Snapshot Job, its associated component template, or components between two runs of the same Snapshot Job. If the Snapshot Job is based on server objects, the change tracking works until the Snapshot Job is not changed or versioned. Any changes or versioning of the Snapshot Job, its associated component template, or components trigger re-baselining by the immediate Snapshot Job run.

Rebaselining

A Snapshot Job, associated component templates, and components are maintained as versioned objects within the system. Targets are not versioned. Versioning of any of these items triggers rebaselining during the next immediate Snapshot Job run.

During rebaselining, the Snapshot job run does the following:

  • Invalidates the baseline and the change tracking data collected by all the previous runs of the same job on all the targets or components
  • Collects and persists the full data of configuration items or server objects.

This new Snapshot Job run becomes the new baseline and any subsequent Snapshot Job runs collect only the change tracking information based on the new baseline and the cycle continues. Rebaselining helps maintain the consistency of the data in the system based on the new changes in the component template, Snapshot Job, and so on.

The following table lists the scenarios that trigger the versioning of different objects:

Object

Actions triggering object versioning and further snapshot baselining

Snapshot Job

Change in the job name, job description, editing of server objects (in case of server objects-based snapshots), editing of component templates (in case of component-based snapshots), editing of the list of targets or components that the job is targeted to run against, or any direct editable properties of the job creates versions of the job object.

Important

This list is not an exhaustive list of actions. Any change to any attribute of a job (except job schedule and job schedule notification) results in the job being versioned.

Component Template

Change in the Component Template name, Component Template description, or any direct editable properties of Component Template, editing of a template part triggers Component template versioning.

Note that this is not an exhaustive list of actions. The Component Template dependency is applicable only in case of component-based snapshots.

Component

Change in the Component name, Component description, or any direct editable properties of Component trigger Component versioning. Also, manual deletion of a component triggers the creation of a new component for the Component Template (when doing "Run Auto discovery " or " Manual Discovery “).

Note that this is not an exhaustive list of actions. This component dependency is applicable only in case of component-based snapshots.

Targets

Targets in TrueSight Server Automation data model are not versioned. However, a target-specific rebaselining is triggered if the target gets decommissioned and gets enrolled again.

Identifying the Snapshot run target result type (baselining, change tracking, and rebaselining)

You can identify whether the Snapshot Job run on a target configuration or server object is a baseline, change tracking, or rebaseline (same as baseline) from the Snapshot job run result windows in the TrueSight Server Automation Console.

The following example illustrates how baselining, change tracking, and rebaselining work.

Alan is an administrator. He wants to create a snapshot based on components for a Windows service, a few files, and registry settings of Windows targets. To achieve this, he creates component templates with the specified template parts and runs a Snapshot job on the Windows targets.

  1. To identify whether the Snapshot Job run is a baseline or a rebaseline (as rebaseline in effect creates a fresh baseline), he checks the change tracking window on a target. The window shows the number of changes on each configuration Item or server object as ‘0‘.
    image1.png
    When he drills down on the configuration item, the following message appears: New baseline has no Change Tracking information.
    Image2.png
  2. If the Snapshot Job run is a change tracking, the change tracking window on a target shows the number of changes (added, modified, deleted) on each configuration Item or server object in comparison to the previous Snapshot Job run.
    image2022-12-21_22-44-29.png
    He further drills down to see the actual change tracking information on what got changed. For instance, a change was detected between Snapshot Job runs for a Windows server a “start type”.
    image2022-12-21_22-43-25.png

  3. If during a subsequent Snapshot Job run (after a baseline run), there is no change to be captured (that means no changes between the previous Snapshot Job run and the current Snapshot Job run), the change tracking window on a target shows the number of changes on each configuration item or server object in comparison to the previous job run to be ‘0’. 
    image2022-12-21_22-46-14.png
    When he drills down on the configuration item, the following message appears: No change detected.

    image2022-12-21_22-47-25.png

  4. The related Component Template gets versioned because Alan removes one configuration Item (Windows service) from the template. The immediate Snapshot Job run detects the new component Template version and triggers rebaselining or baselines again on all the available targets and components. The change tracking window on a target shows the number of changes on each configuration Item or server object as ‘0‘.
    image2022-12-21_22-48-7.png
    When he drills down on the configuration item, the following message appears: New baseline has no Change Tracking information.

    image2022-12-21_22-48-35.png

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*