Standalone UNIX scanning

A scanner file is a

plain text file that is used to simulate the discovery of a system that is unreachable, or one that you are not permitted to scan. You create a scanner file by running the standard discovery commands on a host and saving the output. Only the standard discovery commands are run on the host; information that is discovered by patterns is not available.

Scanning Windows targets

For Windows targets, you cannot download discovery commands. To discover Windows targets, you must use the Standalone-Windows-scanning-tool.

To use scanner files

Create a scanner file:
1. Download the *.sh file from the BMC Discovery user interface.
2. Copy the file to the remote host.
3. Run and capture the output to a file.
Load the scanner file onto the appliance.
1. Using the SCP utility, upload the results file to the appliance as the upload user.

To create a scanner file

From the main menu, click the Administration Settings icon.
The Administration page opens.

In the Discovery section, click Platforms.
Click the OS link that corresponds to the host for which you are creating the scanning file.
The commands for the OS are displayed. The following example illustrates creating a scanner file using the Linux OS.
Click the Download host script link, in this example, linux.sh, highlighted, and save the file to the local computer as an executable.
Copy the file to the remote host.
In the following example, the SCP utility is used to copy the files between the local host teaspoon and the remote host teabag:
tideway@teaspoon:~$ scp linux.sh tideway@teabag:linux.sh
tideway@teabag's password:
linux.sh 100% 19KB 18.9KB/s 00:00
tideway@teaspoon:~$
Log on to the remote host and run the script, piping the output into a text file:
tideway@teaspoon:~$ ssh teabag
tideway@teabag's password:
Linux teabag 2.6.18-6-686 #1 SMP Fri Feb 19 09:31:05 UTC 2016 i686
...
tideway@teabag:~$
tideway@teabag:~$ ./linux.sh > teabag.txt
tideway@teabag:~$ more teabag.txt
FORMAT Linux
--- START device_info
dns_domain: tideway.com
fqdn: teabag
dns_domain:
domain:
os: antiX 15
os_arch: i686
--- END device_info
--- START host_info
kernel: 4.0.5-antix.1-486-smp
num_logical_processors: 2
cores_per_processor: 1
threads_per_core: 2
...
tideway@teabag:~$
Copy the output text file to your local host.
tideway@teabag:~$
tideway@teabag:~$ scp teabag.txt tideway@teaspoon:linux.txt
tideway@teaspoon's password:
teabag.txt 100% 265KB 264.7KB/s 00:00
tideway@teabag:~$
The output file is copied to your local host.

Loading the scanner file onto the appliance

After you have created and copied the output file to your local host, you can copy it to the appliance. In this example, the appliance is called appliance, and the local host is called teaspoon. When loading scanner files onto the appliance, use the upload user, because it has a home directory that is the default location (/usr/tideway/var/scanner) for uploading scanner files, and it has limited access to the appliance. For information about enabling this user, see The-upload-user.

To load the scanner file onto the appliance

Ensure that the file has the group read permission set:
dtweed@teaspoon:~$ chmod 640 teabag.txt
dtweed@teaspoon:~$
Copy the output file to the appliance.
In this example, the SCP utility is used:
dtweed@teaspoon:~$ scp -p teabag.txt upload@appliance:~/linux.teabag.txt
upload@appliance's password:
teabag.txt 100% 265KB 262.7KB/s 00:00
dtweed@teaspoon:~$

When you load a scanner file onto the appliance, its name must be unique; otherwise, it might get overwritten by another scanner file being uploaded at the same time. For this reason, it is helpful to use a naming scheme that enables you to correlate scanner files and created hosts. Do not use a name that starts with a period (.) or ends with .ignore. If you do, that file will be ignored. File names are used only for internal purposes.

Using scanner files with consolidating appliances

Clusters do not directly support scanner files. In order to use scanner files with a clustered consolidator you will need to create a standalone scanner where the scanner file can be uploaded.

If you are using scanner files with a standalone consolidating appliance, upload the scanner files to the consolidating appliance, rather than to the scanning appliance. Doing so correctly identifies the hosts as "Read from scanner file," rather than as "Retrieved by scanning appliance."

After a scanner file is loaded, you can look at the results of the discovery and view the host, as shown in the following illustration.

On the DiscoveryAccess page, in the Data Source field of the Discovery Details section, "Read from scanner file" is displayed, as shown in the following illustration.

Considerations when using scanner files

BMC Discovery automatically initiates a scan of the IP address. You do not need to initiate a scan manually. However, depending on how you set the Scanner File Polling Interval option, it can take up to an hour after the file is copied to the appliance for the scan to initiate. Scanner files are read periodically from the $TIDEWAY/var/scanner directory based on this setting. For more information about setting this option, see Scanning settings.

When scanner files are used, BMC Discovery creates non-expiring pool data by creating a .no-expiry file in the pool data directory $TIDEWAY/var/pool/192/168/1/100/.no-expiry, where the IP address is
192.168.1.100). The pool data is always used for each subsequent discovery and returns identical results until the scanner file is updated or the pool data is deleted.

Hosts discovered by scanner files never age.
BMC Discovery uses scope to handle overlapping IP address ranges. The standalone scanning tools assume only one scope, and the scanner files are processed within the scope of the appliance they are uploaded to.