DiscoveryAccess page

A DiscoveryAccess is a single access to a discovery endpoint. When an endpoint is scanned, a Discovery Access node is created. This node records information about the interaction that BMC Helix Discovery has with that endpoint.

To view a DiscoveryAccess page

You can view DiscoveryAccesses from a number of places in the user interface.

From a host node

From the view page for a host node:

Scroll down to the Inference section.
Click the main link in that section; for example, 172.17.3.116 SUCCESS 17/10/2022 10:48 - 17/10/2022 10:55.
The Example DiscoveryAccess is shown.

From the Discovery Recent Runs page

From the Recent Runs tab of the Discovery Status page:

Click a discovery run.
Scroll down to the Endpoint field.
Click the DiscoveryAccess link.
If the link goes to a single DiscoveryAccess, then that Example DiscoveryAccess is shown. If there are multiple DiscoveryAccesses, then a list page is displayed.
Click a DiscoveryAccess line to view the Example DiscoveryAccess.

Example DiscoveryAccess

The following screens show DiscoveryAccess pages for a UNIX host, a Windows host with multiple credentials, a Windows host discovered with PowerShell, a network device, an indirectly scanned host (an AWS EC2 host), and a mainframe computer. The Windows example shows multiple credentials.

Attribute	Description
Endpoint Section
Endpoint	The endpoint (IP address) scanned in this discovery access.
Discovery Run	A link to the Discovery Run that this DiscoveryAccess is part of.
Previous Discovery Access	A link to the previous DiscoveryAccess with the same endpoint. It is not displayed if it is the first in a list.
Next Discovery Access	A link to the next DiscoveryAccess with the same endpoint. It is not displayed if it is the last in a list.
Device Summary	A read-only summary showing the node kind, OS type, and version.
Scope	The scope from which the endpoint was scanned.
Start Time	The time the scan started. In a consolidator, the Start Time attribute shows the time consolidation of the Discovery Access started. The time the scan started populates the Discovery Start Time. See Discovery Start Time in the Discovery Details Section later.
End Time	The time the scan finished. In a consolidator, the End Time attribute shows the time consolidation of the Discovery Access ended. The time the scan ended populates the Discovery End Time. See Discovery End Time in the Discovery Details Section later.
Total Duration	The time it took to discover and process the data (Start Time to End Time).
Inferred Entity	A link to the inferred entity that was created or updated as part of the scan. It is not displayed if nothing was created or updated.
Scanned Indirectly	Displays the DiscoveryAccess that caused the implicit scan if this DiscoveryAccess is an implicit scan (an EC2 host discovered through AWS Systems Manager, or an ESX and ESXi host discovered through VMware vCenter). Only shown for implicit scans.
Reason for Implicit Scan	Links to the DiscoveryAccess that caused the implicit scan. Only shown for implicit scans.
Caused Implicit Scans	Only shown for a DiscoveryAccess that caused implicit scans. Provides links to the DiscoveryAccess or DiscoveryAccesses that it caused.
Status Section
State	The current state of the DiscoveryAccess. The state can be Started or Finished.
End State	The end state of the discovery run. The end state can be one of the following: Successful discovery results in GoodAccess; during processing, you might see first DeviceIdentified and later HostInferred. For optimized discovery (that is, started but stopped for a reason), you might see Opt1stScan, OptNotBestIP, OptRemote, OptAlreadyProcessing. For unsuccessful discovery, you might see NoResponse, UnsupportedDevice, NoAccess, Excluded, Error. For information about how the end state and result relate to the discovery scenario, see the table in the following section.
Result	The result of the DiscoveryAccess. The result might be Skipped, NoResponse, Success, NoAccess, or Error. For information about how the end state and result relate to the discovery scenario, see the table in the following section.
Errors	If errors were detected by the ECA engine during discovery, this will link to those errors. Examples: Error detected by the ECA engine—This error is typically an internal rule error or pattern error and is usually triggered when the data returned does not match what is expected. Unable to get the deviceInfo: ExecutionFailure—Discovery has attempted to run a command, but a failure has been reported. Unable to get the deviceInfo: NoAccessMethod—No access method. This error frequently occurs because it is not meaningful, such as getting patches on Linux. Unable to get the deviceInfo: NoSuchDevice—A NoResponse endstate; that is, nothing was detected on the IP address. Unable to get the deviceInfo: TRANSIENT Unable to get the deviceInfo: TRANSIENT_CallTimedout—Probably caused by the reasoning timeout; the call to discovery is taking too long to complete. Unable to get the deviceInfo: UNKNOWN—Some other CORBA error. Contact Customer Support.
Session Results	If there were any failures in attempting to get a session on the endpoint, a link to a list of failures and successes is provided. See the following section for details.
Discovery Details Section
Discovery Source	Whether this Discovery Access originated from a BMC Discovery Outpost , or sent from an inferred consolidation sender.
Credentials Used	A link to the credential or credentials used in this Discovery Access. The link name is a hash of details of the credential; it does not provide the credential itself. You are not shown the BMC Discovery Outpost Credential pages if you do not have permissions to view them.
Discovery Start Time (in a consolidator)	In a consolidating system, the time the scan started on the scanner, (see Start Time in the Endpoint section earlier) populates the Discovery Start Time attribute. The Start Time attribute shows the time consolidation of the Discovery Access started.
Discovery End Time (in a consolidator)	In a consolidating system, the time the scan ended on the scanner, (see End Time in the Endpoint section earlier) populates the Discovery End Time attribute.
Discovery Controlled By	Name of the BMC Discovery Outpost that controls the discovery.
Session Establishment Duration	The time it took to establish a session; that is, to log on to the host.
Total Discovery Duration	The time taken to establish a session and run commands.
On Hold Since	If the discovery has been paused, the time at which it was paused.
On Hold Duration	If the discovery has been paused, the elapsed time since it was paused.
Skipped Entity	A summary of the entity that was skipped.
Standard Discovery
Method	The discovery method used. The methods available on each platform are shown on the following pages: UNIX-and-related-operating-systems Windows-operating-systems Mainframe IBM i
Status	The status of the discovery access for the method. This is OK or the failure reason.
Script	The name of the script used, if any.
Access	The access method used to connect to the endpoint (for example, ssh, telnet, rlogin, and so on).
Result	A link to the node or nodes created by this discovery method.
Additional Discovery
Method	The additional discovery method used. These discovery methods are called by patterns; for example: getFileInfo getFileMetadata runCommand getDirectoryListing wbemEnumInstances
Status	The status of the discovery access for the method. This is OK or the failure reason summarized into links. The RequestSkipped status means that the request was skipped as it was inappropriate for the target. For example, when scanning a Linux host, the getServices method is not required, as it is only valid for Windows hosts. The method is now skipped and the DiscoveryAccess reports RequestSkipped . The corresponding getServices method shows in the details field, "Only applies to Windows Hosts."
Script	The name of the script used.
Access	The access method used to connect to the endpoint (or example, ssh, telnet, rlogin, and so on).
Result	A link to the node or nodes created by this discovery method.
Other Endpoint Discovery	A scan of an endpoint creates a DiscoveryAccess. The scan might run additional Discovery requests, such as runCommand, on remote endpoints, adding details of the request to an existing DiscoveryAccess for the remote endpoint. The results are also related to the first (requesting) DiscoveryAccess and are shown on its DiscoveryAccess page, with the following fields shown for each method run. Method Status Script Access Result

DiscoveryAccess state

The following table shows the possible discovery scenarios and the resulting end_state and result attributes of the Discovery Access node:

In addition to end_state and result attributes on the DiscoveryAccess, there is also a reason attribute that contains further details. There is no fixed set of values for reason.

The following state diagram and table might be of use in understanding the results of an attempted access.

Discovery Scenario	Resulting State of DiscoveryAccess
IP Injected → In Exclude list Example: The user has requested a scan of an IP address that is in an exclude range.	end_state=Excluded result=Skipped
IP Injected → IP Response → Desktop host Example:The user has requested a scan of an IP address that is a desktop host when scanning of desktop hosts has been disabled. The reason attribute is populated with Desktop host discovery has been disabled.	end_state=Excluded result=Skipped
IP Injected → Already Processing this IP Example: The user has requested a scan of an IP address that is currently being processed as part of an earlier scan.	end_state=OptAlreadyProcessing result=Skipped
IP Injected → Second Scan Optimization (Best IP) Example: The user has requested a scan of an IP address that is on a host that has already been scanned using another IP address that is considered to be the best IP address to use to scan that host.	end_state=OptNotBestIP result=Skipped
IP Injected → No IP Response Example: No response was received from the scanned IP address. The IP address is considered dark space, and no DiscoveryAccess node is created.
IP Injected → IP Response Example: After a sweep scan of an IP address, Discovery has received a response. No identification has taken place other than that a device of some description has responded to the sweep scan. If the device is subsequently not recognized, the end_state is set to UnsupportedDevice as described in the following section.	end_state=DeviceIdentified result=Success
IP Injected → IP Response → Device Type not supported UnsupportedDevice is the default end_state for any device that BMC Helix Discovery can detect but does not have any knowledge of in Reasoning to build an inferred node. We might still be able to identify what the device is and some key properties, or we might know nothing more than the fact that it returned a ping. Example: Discovery has received a response from an endpoint but has not been able to further identify the device. This might mean that the OS is unrecognized, garbage has been returned, or a shell error has occurred. This can be caused by a firewall. For more information, see the IP Fingerprinting information in the Base Device Discovery section.	end_state=UnsupportedDevice result=Skipped
IP Injected → IP Response → No HostInfo recovered	end_state=NoAccess result=NoAccess
IP Injected → IP Response → No MACAddresses recovered	end_state=NoAccess result=NoAccess
IP Injected → IP Response → HostInfo and MACAddresses recovered	end_state=HostInferred result=Success
IP Injected → IP Response → HostInfo and MACAddresses recovered → First Scan Optimization	end_state=Opt1stScan result=Skipped
IP Injected → IP Response → HostInfo and MACAddresses recovered → First Scan Optimization not needed	end_state=GoodAccess result=Success
IP Injected → Traceback captured	end_state=Error\|ExistingState result=Error
IP Consolidated when originally optimized on Discovery Appliance	end_state=OptRemote result=Skipped

Troubleshooting using session results

Three scenarios are highlighted using Session Results:

Initial scan and successful connection—A number of unsuccessful connection attempts followed by a successful connection shows BMC Helix Discovery selecting credentials.
Failure to connect—BMC Helix Discovery was unable to connect. Typical problems could be failed credentials or poor network connectivity.
Failure at start of scan before successful connection—This failure can occur when a credential fails (expiry) but a later credential is successful.

Checking credentials after a failure

From the Discovery Access, click the session results link.
Click the Connection timed out rows to display the SessionResult page for that specific login attempt.
This page shows information about the attempted login, including a credential link and a link to the DiscoveryAccess. The credential link is a hash of the credential name that links to that credential on the Login Credentials page only if you have sufficient permissions to view the credentials.
Click the test button.
If the credential tests successfully, it is likely that a transient network problem caused the connection timeout. Alternatively, you can navigate back to the Discovery Access page and rescan from the Discovery Actions menu.

For information on using the DiscoveryAccess page to troubleshoot scan failures, see the following video (02:04):

https://youtu.be/-TldKOQD_Ls