Understand the IEC

IEC: Segment 1 | IEC: Segment 2 | IEC: Segment 3 | IEC: Optional Segments

Introduction

Incident Error Code (IEC) is a Unique Code, auto-generated by Discovery Admin and assigned to every actionable Log generated by ServiceNow Discovery. The Incident Error Code plays a crucial role to determine the appropriate action required to remediate the identified error.

Each actionable error is assigned a unique IEC derived from various inputs driven by:

Log Entries generated by ServiceNow Discovery (across the Discovery Log, Device History, ECC Queue, and Pattern Log)
Data Lookups (Discovery Schedule Lookup, Credential Affinity Lookup, CMDB Hierarchy Lookup, IP Address Table Lookup)
Historical IECs associated with this IP Address
Additional contextual insights provided by the Customer

The Incident Error Code Mapping (IECM) is the underlying rule(s) that determines the IEC for a specific actionable Log entry. One IEC can have more than one IECM.

Creating a new IECM Rule(s) can override existing out-of-the-box Rules to generate the most relevant IEC for the Customer.

IEC: Standard Format

The standard format for any IEC is:

P#.TYPE.NN.[OPTIONAL_SEGMENTS]

... where every segment of the IEC is separated with a dot.

IEC: Segment 1

The first segment of the IEC represents the Phase of ServiceNow Discovery.

It consists of a 'P' followed by a number between 0-5.

P0 (Design Phase):

P0 represents the Design issues that are related to Discovery Schedules and MID Server Failures.

Not fixing these errors results in incomplete ServiceNow Discovery scans.

P1 (Port Scan Phase):

P1 represents the issues that are related to Phase 1 or the Port Scan (Shazzam) Phase of ServiceNow Discovery. These include errors associated with connectivity and network access.

Not fixing these errors results in the omission of potentially large segments of the network from being scanned by ServiceNow Discovery.

P2 (Classification Phase):

P2 represents the issues that are related to Phase 2 or the Classification Phase of ServiceNow Discovery. These include errors associated with authentication and lockouts.

Not fixing these errors results in those CIs not being created or updated in the CMDB.

P3 (Identification Phase with Probes and Sensors):

P3 represents the issues that are related to Phase 3 or the Identification Phase of ServiceNow Discovery. These include errors associated with the determination of which record will be updated or created in the CMDB.

Not fixing these errors results in duplicates in the CMDB.

P4 (Exploration phase with Probes and Sensors):

P4 represents the issues that are related the Phase 4 or the Exploration Phase of ServiceNow Discovery. These include errors associated with retrieving additional attributes on the CI.

Not fixing these errors results in incomplete CI data in the CMDB.

P5 (Identification and Exploration with Patterns):

P5 represents issues that are related to the Phase 3 (Identification Phase) and Phase 4 (Exploration Phase) corresponding to the Patterns. These two phases are combined as Patterns (unlike Probes and Sensors) do both Identification and Exploration.

Not fixing these errors results in errors associated with Phase 3 and Phase 4 of ServiceNow Discovery described above.

IEC: Segment 2

The second segment of the IEC represents the Protocol, Technology, Pattern Name, or Category associated with the specific error.

Examples include:

SCHD: ServiceNow Discovery Schedule Design
SSH: Unix / Linux OS-based infrastructure
SNMP: Network infrastructure
WMI: Windows OS-based infrastructure
VMW: VMware
Apache: Web server
Tomcat: Application server

IEC: Segment 3

The 3rd Segment of the IEC is a two-digit number representing the order of the errors, as we come across them.

Additionally:

00 in the 3rd Segment indicates a catch-all Generic error
99 in the 3rd Segment indicates a catch-all Ignore error

IEC: Optional Segment(s)

The Optional Segment(s) in the Incident Error Code provides additional information about the error.

Examples of suffixes include:

LOOKUP: Indicates that the IP address was found in the CMDB
NoDNS: Indicates that no DNS name was returned in the Logs
Ignore: This indicates that this error can be ignored due to other more relevant errors in the Logs

Each Optional Segment is further separated with a dot.

Customers can Create and Manage IECs and IECMs to extend the out-of-the-box IECs shipped with Discovery Admin by creating new IECs (with new suffixes) aligned with their use cases to Eliminate Noise and Increase Granularity.

IEC: Examples

We have 100s of different IECs that ship out-of-the-box with Discovery Admin. Each of them has a unique interpretation based on their Standard Format.

Here are a few examples of IECs and what they mean:

P0.SCHD.04: Design Error with the Discovery Schedule
P1.ALL.99.Ignore: Generic error during the Network Scan Phase, which can be Ignored as it is not actionable
P2.WMI.01: WMI Protocol (for Windows Devices) Classification Error (with DNS Name available in the Logs)
P2.SNMP.01.NoDNS: SNMP Protocol (for Network Devices) Classification Error (with No DNS Name available in the Logs)
P2.SNMP.01.Router.LOOKUP: SNMP Protocol (for Network Devices) Classification Error (with DNS Name available in the Logs) for a Router (confirmed based on the presence of the IP Address Lookup in the CMDB).
P2.SNMP.03.Ignore.ESX.LOOKUP: SNMP Protocol Error on an ESX Server (confirmed based on the presence of the IP Address Lookup in the CMDB), which can be Ignored as ESX Servers are discovered via vCenter and not SNMP.
P2.WMI.12.NoDNS.Workstation.LOOKUP: WMI Protocol (for Windows Devices) Classification Error (with No DNS Name available in the Logs) on a Workstation (confirmed based on the presence of the IP Address Lookup in the CMDB).
P3.SSH.02: SSH Protocol (for UNIX / Linux Devices) Identification error (with DNS Name available in the Logs)
P4.VMW.01: Exploration Error for vCenter / VMware
P5.IIS.00: Generic Pattern error for the IIS Pattern
P5.Windows.01: Pattern error for the Windows Pattern

As you get more familiar with the IECs generated for the ServiceNow Discovery Logs in your environment, the IEC will be an intuitive indicator of the implication of the error.