Discovering Devices

This section describes how to use discovery in SL1 to find devices on your network. You can use the Add Devices button on the Devices () page or the Discovery Sessions page (Devices > Discovery Sessions) to start a discovery process, or you can run a "Classic Discovery" from the Discovery Control Panel page (System > Manage > Classic Discovery).

Use the following menu options to navigate the SL1 user interface:

To view a pop-out list of menu options, click the menu icon ().
To view a page containing all of the menu options, click the Advanced menu icon ().

Prerequisites for Discovering Devices

To discover all of the devices on your network:

Make a note of the range of IP addresses used on your network. If your device does not have an IP address, make a note of the name of the root device. If you need help, ask your network administrator.
An Organization must exist in SL1 for the new devices. If you need to create an Organization, go to the Organizations page (Registry > Accounts > Organizations).
A Collector Group must exist in SL1 that can reach the target device using a valid network path for the needed protocol. For example, UDP 161 for SNMP and general ICMP traffic for Ping. If you are not sure of the Collector Group to use, consult an SL1 Architecture diagram or ask your SL1 System Administrator. You can access collector information on the Collector Group Management page (System > Settings > Collector Groups).
You must create or use an existing credential. You can access credential information on the Credentials page (Manage > Credentials). Because credential problems are the most common cause for discovery failure, you can test any credential that you create on the Credential Test Management page (System > Customize > Credential Tests).
If you want to use a device template with a discovery session, you must use an existing template in SL1. You can access device templates on the Configuration Templates page (Devices > Templates).
The Grant All user needs to be used to access new discovery workflow, as the SYS_SETTINGS_LICENSES_PAGE and SYS_SETTINGS_CUGS_PAGE access keys are needed to get collector or collector group information. For more information, see the Access Keys page (System > Manage > Access Keys).

If you want to discover one of the third-party products that are available as an option when using guided discovery, you must have the corresponding PowerPack installed on your SL1 system. For example, if you want to discover an Amazon Web Services account, you must have the Amazon Web Services PowerPack installed.

Adding Devices Using Guided Discovery

On the Devices page () or the Discovery Sessions page (Devices > Discovery Sessions), you can add or "discover" new devices for monitoring in SL1. You add devices by creating a discovery session, which searches for devices on the network you specify.

The guided discovery process lets you select a discovery type specific to the type of devices you want to monitor, in addition to traditional SNMP discovery. The guided discovery wizard provides a filtered list of relevant credentials, the ability to create new credentials, and a reduced set of application-specific fields to help you efficiently discover the devices you need.

The following procedure uses Amazon Web Services as an example of the discovery type. Some steps and fields will vary depending on the discovery type.

To run a guided discovery:

On the Devices page () or the Discovery Sessions page (Devices > Discovery Sessions), click the Add Devices button. The Select page appears.
Select the type of devices you want to discover. You can choose one of the following device types:

Alibaba Cloud
AWS

AWS EC2
AWS IAM
AWS Assume Role

Azure
Citrix
Google Cloud
IBM
Ping
SNMP
VMware
Windows

Windows WMI
Windows PowerShell
Windows Agent

Additional information about the requirements for device discovery appears in the General Information pane to the right.

When executing AWS guided workflow discoveries, executing the same workflow or workflows with similar settings can result in asset duplication. For IAM guided workflows, this will result in completely duplicated account device component trees. For other AWS workflows, this might result in duplicated virtual devices that represent the AWS organization.

If you want to do a more general discovery, you can select one of the options in the Other ways to add devices pane, such as Unguided Network Discovery. For more information, see Adding Devices Using Unguided Discovery.

Click Select. The Credential Selection page appears, which is the first step in the guided discovery session.

The contents of this page might vary depending on the discovery type you selected at the start of the Guided Discovery.

If the credential you want to use for discovery is already listed on the Credential Selection page and does not need to be edited, proceed to step 5. Otherwise, you can optionally do one of the following:

If the credential you need is not in the list, click the Create New button to open the Create Credential window, where you can specify the name and organization for the credential, the third-party username and password, and other data such as Cloud Type and Proxy information. You can also test the credential before you save using the Credential Tester panel. Click Save & Close to save the credential and return to the Credential Selection page of the guided discovery session. For more information on creating new credentials or testing credentials, see the section on Defining Credentials or Using the Credential Tester Panel.
To edit a credential on the Credential Selection page, click the name of the credential you would like to edit from the Name column and edit that credential as needed. You can also test the credential before you save using the Credential Tester panel. Click the Save & Close button on the Edit Credential window to save your updates.

During the guided discovery process, you cannot click Next until the required fields are filled on the page.

On the Credential Selection page of the guided discovery process, select a credential to allow SL1 to access the device that will act as the root device for the system being discovered, and then click Next. The Discovery Session Name page appears, which is the second step in the guided discovery session.

The contents of this page might vary depending on the discovery type you selected at the start of the Guided Discovery.

Complete the following fields, as applicable:

Discovery Session Name. Type a name for the discovery session.
Root Device Name. Type the name of the root device for the application you want to monitor.
Scope of Discovery. If you are discovering Google Cloud devices, select whether you are discovering them at the Organization Level or the Project Level. For more information, see the section on Monitoring Google Cloud.
Select the organization to add discovered devices to. Select the name of the organization to which you want to add the discovered device.
Collector Group Name. Select an existing collector group to communicate with the discovered device. This field is required.

When assigning devices to a collector group, SL1's multi-tenancy rules will validate that the collector group you select belongs to the organization you selected in the previous field. If you attempt to run a discovery session where the devices, collector group, and credentials do not all belong to the same organization, you will receive an error message and will not be able to save or execute the discovery session.

IP. Type the IP addresses for SL1 to scan during discovery.

Some applications, such as VMware, require that you enter an IP address for the root device as well.

Click Next. SL1 creates a root device with the appropriate Device Class assigned to it and aligns the relevant Dynamic Applications. The Device Discovery Completed page appears, which is the third and final step of the guided discovery session. As SL1 discovers your devices, system messages relating to the discovery appear on the page under the heading "Discovery Logs".

If SL1 cannot determine the appropriate Device Class, it will assign the device to the Generic SNMP Device Class.

When discovery has finished, click Close.

The results of a guided discovery do not display on the Discovery Sessions page (Devices > Discovery Sessions). However, you can retrieve details of saved Guided Discovery Sessions with the guidedDiscoverySessions GraphQL query. Details for discovery sessions that create a virtual root device are not currently displayed in the user interface.

Adding Devices Using Unguided Discovery

Instead of running a Discovery for a specific discovery type, you can run an "unguided" discovery to find a range of devices using core credentials such as SNMP, Database, SOAP/XML, Basic/Snippet, SSH/Key, or PowerShell credentials.

To run an unguided discovery:

On the Devices page () or the Discovery Sessions page (Devices > Discovery Sessions), click the Add Devices button. The Select page appears.
Click the Unguided Network Discovery Workflow button. Additional information about the requirements for discovery appears in the General Information pane to the right.
Click Select. The Add Devices page appears.
Complete the following fields:

Discovery Session Name. Type a unique name for this discovery session. This name is displayed in the list of discovery sessions on the Discovery Sessions tab.
Description. Type a short description of the discovery session. You can use the text in this description to search for the discovery session on the Discovery Sessions tab. Optional.
Select the organization to add discovered devices to. Select the name of the organization to which you want to add the discovered devices.

Click Next. The Credentials page of the Add Devices wizard appears.
On the Credentials page, you can optionally do one of the following:

If the credential you need is not in the list, click the Create New button to open the Create Credential window, where you can specify the name and organization for the credential, the third-party username and password, and other data such as Cloud Type and Proxy information. You can also test the credential before you save using the Credential Tester panel. Click Save & Close to save the credential and return to the Credential Selection page of the guided discovery session. For more information on creating new credentials or testing credentials, see the section on Defining Credentials or Using the Credential Tester Panel.
To edit a credential on the Credential Selection page, click the name of the credential you would like to edit from the Name column and edit that credential as needed. You can also test the credential before you save using the Credential Tester panel. Click the Save & Close button on the Edit Credential window to save your updates.

On the Credentials page of the Add Devices wizard, select one or more credentials to allow SL1 to access a device's SNMP data and click Next. The Discovery Session Details page of the Add Devices wizard appears.
Complete the following fields:

List of IPs/Hostnames. Provide a list of IP addresses, hostnames, or fully-qualified domain names for SL1 to scan during discovery. This field is required. In this field, you can enter a combination of one or more of the following:

One or more single IPv4 addresses separated by commas and a new line. Each IP address must be in standard IP notation and cannot exceed 15 characters. For example, "10.20.30.1, 10.20.30.2, 10.20."
One or more ranges of IPv4 addresses with "-" (dash) characters between the beginning of the range and the end of the range. Separate each range with a comma. For example, "10.20.30.1 – 10.20.30.254".

One or more IP address ranges in IPv4 CIDR notation. Separate each item in the list with a comma. For example, "192.168.168.0/24".
One or more ranges of IPv6 addresses with "-" (dash) characters between the beginning of the range and the end of the range. Separate each range with a comma. For example, "2001:DB8:0:0:0:0:0:0-2001:DB8:0:0:0:0:0:0003".
One or more IP address ranges in IPv6 CIDR notation. Separate each item in the list with a comma. For example, "2001:DB8:0:0:0:0:0:0/117".
One or more hostnames (fully-qualified domain names). Separate each item in the list with a comma.

You can also click the Upload File button to upload a comma-separated list of IPs.

Which collector will monitor these devices?. Select an existing collector group to monitor the discovered devices. Required.

Run after save. Select this option to run this discovery session as soon as you click Save and Close.
Advanced options. Click the down arrow icon () to access additional discovery options.

In the Advanced options section, complete the following fields as needed:

Initial Scan Level. For this discovery session only, specifies the data to be gathered during the initial discovery session. The options are:

System Default (recommended). Use the value defined in the Behavior Settings page (System > Settings > Behavior) in the classic user interface of SL1.
1. Model Device Only. Discovery will discover if the device is up and running and if so, collect the make and model of the device. SL1 will then generate a device ID for the device so it can be managed by SL1.
2. Initial Population of Apps. Discovery will search for Dynamic Applications to associate with the device. The discovery tool will attempt to collect data for the aligned Dynamic Applications. Discovery will later retrieve full sets of data from each Dynamic Application. Discovery will also perform 1. Model Device Only discovery.
3. Discover SSL Certificates. Discovery will search for SSL certificates and retrieve SSL data. Discovery will also perform 2. Initial Population of Apps and 1. Model Device Only.
4. Discover Open Ports. Discovery will search for open ports. Discovery will also perform 3. Discover SSL Certificates, 2. Initial Population of Apps, and 1. Model Device Only.

If your system includes a firewall and you select 4. Discover Open Ports, discovery might be blocked and/or might be taxing to your network.

5. Advanced Port Discovery. Discovery will search for open ports, using a faster TCP/IP connection method. Discovery will also perform 3. Discover SSL Certificates, 2. Initial Population of Apps, and 1. Model Device Only.

If your system includes a firewall and you select 5. Advanced Port Discovery, some devices might remain in a pending state (purple icon) for some time after discovery. These devices will achieve a healthy status, but this might take several hours.

6. Deep Discovery. Discovery will use nmap to retrieve the operating system name and version. Discovery will also scan for services running on each open port and can use this information to match devices to device classes. Discovery will search for open ports, using a faster TCP/IP connection method. Discovery will also perform 3. Discover SSL Certificates, 2. Initial Population of Apps, and 1. Model Device Only.

For devices that don't support SNMP, option 6. Deep Discovery allows you to discover devices that don't support SNMP and then align those devices with a device class other than "pingable". Note that option 6. Deep Discovery is compute-intensive.

If SL1 cannot determine the appropriate Device Class, it will assign the device to the Generic SNMP Device Class.

Scan Throttle. Specifies the amount of time a discovery process should pause between each specified IP address (specified in the IP Address/Hostname Discovery List field). Pausing discovery processes between IP addresses spreads the amount of network traffic generated by discovery over a longer period of time. The choices are:

System Default (recommended). Use the value defined in the Behavior Settings page (System > Settings > Behavior) in the classic user interface for SL1.
Disabled. Discovery processes will not pause.
1000 Msec to 10000 Msec. A discovery process will pause for a random amount of time between half the selected value and the selected value.

Port Scan All IPs. For the initial discovery session only, specifies whether SL1 should scan all IP addresses on a device for open ports. The choices are:

System Default (recommended). Use the value defined in the Behavior Settings page (System > Settings > Behavior) in the classic user interface for SL1.
Enabled. SL1 will scan all discovered IP addresses for open ports.
Disabled. SL1 will scan only the primary IP address (the one used to communicate with SL1) for open ports.

Port Scan Timeout. For the initial discovery session only, specifies the length of time, in milliseconds, after which SL1 should stop trying to scan an IP address for open ports and begin scanning the next IP address (if applicable). Choices are:

System Default (recommended). Use the value defined in the Behavior Settings page (System > Settings > Behavior).
Choices between 60 to 1,800 seconds.

Scan Ports. Specify a list of ports to scan, separated by colons (:). The default is 21:22:25:80:136.
Interface Inventory Timeout (ms). Specifies the maximum amount of time that the discovery processes will spend polling a device for the list of interfaces. After the specified time, SL1 will stop polling the device, will not model the device, and will continue with discovery. The default value is 600,000 ms (10 minutes).

During the execution of this discovery session, SL1 uses the value in this field first. If you delete the default values and do not specify another value in this field, SL1 uses the value in the Global Threshold Settings page (System > Settings > Thresholds).
If you specify a value in this field and do not apply a device template to this discovery session, the Interface Inventory Timeout setting in the Device Thresholds page (Registry > Devices > Device Manager > wrench icon > Thresholds) is set to this value for each discovered device. If there is no device template applied to the discovery session and no value is supplied in this field, SL1 uses the value in the Global Threshold Settings page (System > Settings > Thresholds).

Maximum Allowed Interfaces. Specifies the maximum number of interfaces per devices. If a device exceeds this number of interfaces, SL1 will stop scanning the device, will not model the device, and will continue with discovery. The default value is 10,000.

During the execution of this discovery session, SL1 uses the value in this field first. If you delete the default values and do not specify another value in this field, SL1 uses the value in the Global Threshold Settings page.
If you specify a value in this field and do not apply a device template to this discovery session, the Maximum Allowed Interfaces setting in the Device Thresholds page is set to this value for each discovered device. If there is no device template applied to the discovery session and no value is supplied in this field, SL1 uses the value in the Global Threshold Settings page.

Bypass Interface Inventory. Specifies whether or not the discovery session should discover network interfaces.

Selected. SL1 will not attempt to discover interfaces for each device in the discovery session. For each discovered device, the Bypass Interface Inventory checkbox on the Device Investigator Settings tab will be selected.
Not Selected. SL1 will attempt to discover network interfaces, using the Interface Inventory Timeout value and Maximum Allowed Interfaces value.

Discover Non-SNMP. Specifies whether or not SL1 should discover devices that don't respond to SNMP requests.

Selected. SL1 will discover devices that don't respond to the SNMP credentials selected in the SNMP Credentials field. These devices will be discovered as "pingable" devices.
Not Selected. SL1 will not discover devices that don't respond to the SNMP credentials selected in the SNMP Credentials fields.

You must either select a credential for the discovery session or select the Discover Non-SNMP option. SL1 will prevent you from proceeding with discovery if you have not met those conditions.

Model Devices. Determines whether or not the devices that are discovered with this discovery session can be managed through SL1. Choices are:

Enabled. When a device is modeled, SL1 creates a device ID for the device; you can then access the device through the Device Manager page and manage the device in SL1.
Disabled. If a device is not modeled, you cannot access the device through the Device Manager page, and you cannot manage the device in SL1. However, each discovered device will still appear in the Discovery Session logs. For each discovered device, the discovery logs will display the IP address and device class for the device. This option is useful when performing an initial discovery of your network, to determine which devices you want to monitor and manage with SL1. For the amount of time specified in the Device Model Cache TTL (h) field, a user can manually model the device from the Discovery Session window.

Enable DHCP. Specifies whether or not the specified range of IPs and hostnames use DHCP.

Selected. SL1 will perform a DNS lookup for the device during discovery and each time SL1 retrieves information from the device.
Not Selected. SL1 will perform normal discovery.

Device Model Cache TTL (h). Amount of time, in hours, that SL1 stores information about devices that are discovered but not modeled, either because the Model Devices option is not enabled or because SL1 cannot determine whether a duplicate device already exists. The cached data can be used to manually model the device from the Discovery Session window.
Log All. Specifies whether or not the discovery session should use verbose logging. When you select verbose logging, SL1 logs details about each IP address or hostname specified in the IP Address/Hostname Discovery List field, even if the results are "No device found at this address."

Selected. This discovery session will use verbose logging.
Not Selected. This discovery session will not use verbose logging.

Apply Device Template. As SL1 discovers a device in the IP discovery list, that device is configured with the selected device template. You can select from a list of all device templates in SL1. For more information on device templates, see the Device Groups and Device Templates section.

Click Save and Close to save the discovery session. The Discovery Sessions page (Devices > Discovery Sessions) displays the new discovery session.
If you selected the Run after save option on this page, the discovery session runs, and the Discovery Logs page displays any relevant log messages. If the discovery session locates and adds any devices, the Discovery Logs page includes a link to the Device Investigator page for the discovered device.

Working with Discovery Sessions

The Discovery Sessions page (Devices > Discovery Sessions) displays a list of all the existing discovery sessions, which are previous attempts to add devices using discovery.

On this page you can click the Actions button () for a session and select one of the following actions:

Edit. Run the Add Device wizard again so you can make changes to the selected discovery session.
Delete. Delete the selected discovery session. You do not get a confirmation window after you click Delete; the session is immediately deleted.
Start. Run the selected discovery session again. The Discovery Logs page appears when discovery completes.
Show Logs. The Discovery Logs page for the selected discovery session displays data about the most recent run of a discovery session.

You can adjust the size of the rows and the size of the row text on this inventory page. For more information, see the section on Adjusting the Row Density.

From the Discovery Sessions page, you can also add devices using guided or unguided discovery by clicking the Add Devices button. For instructions on using guided discovery, see the section on Adding Devices Using Guided Discovery. For instructions on using unguided discovery, see the section on Adding Devices Using Unguided Discovery.

Managing Classic Discovery Sessions

The following sections describe how to view, create, and manage classic discovery sessions in SL1.

Viewing Information about a Classic Discovery Session

The Session Register pane in the Discovery Control Panel (System > Manage > Classic Discovery) page displays information about all discovery sessions defined in SL1.

To sort the list of discovery sessions, click on a column heading. The list will be sorted by the column value, in ascending order. To sort by descending order, click the column heading again. The Last Edit column sorts by descending order on the first click; to sort by ascending order, click the column heading again.

For each session, the Session Register displays:

Session Name. Name of the discovery session. This field is optional.
IP/Hostname List. The range of IP addresses and/or hostnames for SL1 to scan during discovery. This field can contain a combination of one or more of the following:

One or more single IPv4 addresses separated by commas. Each IP address must be in standard IP notation and cannot exceed 15 characters. For example, "10.20.30.1, 10.20.30.2, 10.20.30.3".
One or more ranges of IPv4 addresses with "-" (dash) characters between the beginning of the range and the end of the range. Separate each range with a comma. For example, "10.20.30.1 – 10.20.30.254".
One or more IP address ranges in IPv4 CIDR notation. Separate each item in the list with a comma. For example, "192.168.168.0/24".
One or more ranges of IPv6 addresses with "-" (dash) characters between the beginning of the range and the end of the range. Separate each range with a comma. For example, "2001:DB8:0:0:0:0:0:0-2001:DB8:0:0:0:0:0:0003".
One or more IP address ranges in IPv6 CIDR notation. Separate each item in the list with a comma. For example, "2001:DB8:0:0:0:0:0:0/117".
One or more fully-qualified domain names or hostnames.

NOTE: The following types of notation are not supported: IPv4 netmask with comma notation (192.168.168.0,24); a list of single IPv6 addresses, separated by comma.

Collector. Data Collector used for the discovery session.
Organization. The organization to which devices discovered during the discovery session will be assigned.
Pings. This field specifies whether or not SL1 should discover devices that don't respond to the selected SNMP credentials. The possible values are:

Yes. SL1 will discover devices that don't respond to the SNMP credentials selected in the SNMP Credentials field for the discovery session. These devices will be discovered as "pingable" devices.
No. SL1 will not discover devices that don't respond to the SNMP credentials selected in the SNMP Credentials field for this discovery session.

Rediscovery. Specifies whether or not SL1 is scheduled to run this discovery session, and if so, the frequency and time specified in the schedule.
User Edit. Name of user who created or last edited the discovery session.
Last Edit. Date and time discovery session was created or last edited.

To filter the list of discovery sessions in the Session Register, use the search fields at the top of each column. The search fields are find-as-you-type filters; as you type, the page is filtered to match the text in the search field, including partial matches. Text matches are not case-sensitive. Additionally, you can use the following special characters in each filter:

, (comma). Specifies an "or" operation. For example:

"dell, micro" would match all values that contain the string "dell" OR the string "micro".

& (ampersand). Specifies an "and" operation. For example:

"dell & micro" would match all values that contain the string "dell" AND the string "micro".

! (exclamation mark). Specifies a "not" operation. For example:

"!dell" would match all values that do not contain the string "dell".

^ (caret mark). Specifies "starts with." For example:

"^micro" would match all strings that start with "micro", like "microsoft".

"^" will include all rows that have a value in the column.

"!^" will include all rows that have no value in the column.

$ (dollar sign). Specifies "ends with." For example:

"$ware" would match all strings that end with "ware", like "VMware".

"$" will include all rows that have a value in the column.

"!$" will include all rows that have no value in the column.

min-max. Matches numeric values only. Specifies any value between the minimum value and the maximum value, including the minimum and the maximum. For example:

"1-5" would match 1, 2, 3, 4, and 5.

- (dash). Matches numeric values only. A "half open" range. Specifies values including the minimum and greater or including the maximum and lesser. For example:

"1-" matches 1 and greater, so it would match 1, 2, 6, 345, etc.

"-5" matches 5 and less, so it would match 5, 3, 1, 0, etc.

> (greater than). Matches numeric values only. Specifies any value "greater than." For example:

">7" would match all values greater than 7.

< (less than). Matches numeric values only. Specifies any value "less than." For example:

"<12" would match all values less than 12.

>= (greater than or equal to). Matches numeric values only. Specifies any value "greater than or equal to." For example:

"=>7" would match all values 7 and greater.

<= (less than or equal to). Matches numeric values only. Specifies any value "less than or equal to." For example:

"=<12" would match all values 12 and less.

= (equal). Matches numeric values only. For numeric values, allows you to match a negative value. For example:

"=-5 " would match "-5" instead of being evaluated as the "half open range" as described above.

Running a Classic Discovery Session

To perform a discovery session for one IP address, multiple IP addresses, or a range of IP addresses on the Classic Discovery page:

To discover all the devices in your network, you must first know the range of IP addresses used in your network. If you need help, ask your network administrator.

Go to the Discovery Control Panel page (System > Manage > Classic Discovery).
In the Discovery Control Panel, click Create. The Discovery Session Editor page appears:
Supply values in the following fields:

Name. Type a name for the discovery session. This name is displayed in the list of discovery sessions in the Discovery Control Panel page.
Description. Optionally, type a description of the discovery session.
IP Address/Hostname Discovery List. Provide a list of IP addresses or fully-qualified domain names for SL1 to scan during discovery. In this field, you can enter a combination of one or more of the following:

Instead of manually entering a list of IP addresses and hostnames, you can upload a file that contains the list of IP addresses and hostnames. See the description of the Upload File field.

One or more single IPv4 addresses separated by commas. Each IP address must be in standard IP notation and cannot exceed 15 characters. For example, "10.20.30.1, 10.20.30.2, 10.20.30.3".
One or more ranges of IPv4 addresses with "-" (dash) characters between the beginning of the range and the end of the range. Separate each range with a comma. For example, "10.20.30.1 – 10.20.30.254".
One or more IP address ranges in IPv4 CIDR notation. Separate each item in the list with a comma. For example, "192.168.168.0/24".
One or more ranges of IPv6 addresses with "-" (dash) characters between the beginning of the range and the end of the range. Separate each range with a comma. For example, "2001:DB8:0:0:0:0:0:0-2001:DB8:0:0:0:0:0:0003".
One or more IP address ranges in IPv6 CIDR notation. Separate each item in the list with a comma. For example, "2001:DB8:0:0:0:0:0:0/117".
One or more hostnames (fully-qualified domain names). Separate each item in the list with a comma.

If you enter both the hostname and IP address of the same devices, SL1 will discover two duplicate devices.

The following types of notation are not supported: IPv4 netmask with comma notation (e.g., 192.168.168.0,24); a list of single IPv6 addresses, separated by comma.

SL1 will display an error if your discovery session exceeds the maximum size for optimum performance. SL1 will display a warning message if your discovery session includes 100 or more IP addresses. The warning message will tell you that discovery with more than 100 IP addresses might "take a long time to discover".

Upload File. Instead of manually entering a list of IP addresses and hostnames in the IP Address/Hostname Discovery List field, you can upload a file that contains a list of IP addresses and hostnames. The IP addresses and hostnames in the file must be in a format that is allowed for the IP Address/Hostname Discovery List field. Each address or range of addresses in the file must be separated by a newline character instead of a comma. You can browse to the file and then select it. After uploading the file, the IP Address/Hostname Discovery List field will display the IP addresses and hostnames from the file.
SNMP Credentials. A community string that allows SL1 to access a device's SNMP data. SNMP credentials are defined in the Credential Management page (System > Manage > Credentials). If you want to retrieve SNMP data from one or more devices, you must select one or more working SNMP credentials in this field. You can select multiple credentials from this field. SL1 will try each selected credential when discovering devices and retrieving device data.
Other Credentials. A username and password pair (among other fields) that allows SL1 to access a device's database data, SOAP data, XML data, WMI data, WBEM data, or data that is monitored with a Snippet Dynamic Application. These credentials are defined in the Credential Management page (System > Manage > Credentials). You can select multiple credentials from this field. SL1 will try each selected credential when searching for Dynamic Applications to align with each discovered device.

You can use the field at the top of the SNMP Credentials field and the Other Credentials field to filter the list of credentials. If you enter an alpha-numeric string in the field, the SNMP Credentials field or the Other Credentials field will include only credentials that match the string.

Your organization membership(s) might affect the list of credentials you can see in the SNMP Credentials field and the Other Credentials field.

Initial Scan Level. For this discovery session only, specifies the data to be gathered during the initial discovery session. The options are:

System Default (recommended). Use the value defined in the Behavior Settings page (System > Settings > Behavior).
0. Model Device Only. Discovery will discover if the device is up and running and if so, collect the make and model of the device. SL1 will then generate a device ID for the device so it can be managed by SL1.
1. Initial Population of Apps. Discovery will search for Dynamic Applications to associate with the device. The discovery tool will attempt to collect data for the aligned Dynamic Applications. Discovery will later retrieve full sets of data from each Dynamic Application. Discovery will also perform 0. Model Device Only discovery.
2. Discover SSL Certificates. Discovery will search for SSL certificates and retrieve SSL data. Discovery will also perform 1. Initial Population of Apps and 0. Model Device Only.
3. Discover Open Ports. Discovery will search for open ports. Discovery will also perform 2. Discover SSL Certificates, 1. Initial Population of Apps, and 0. Model Device Only.

If your system includes a firewall and you select 3. Discover Open Ports, discovery might be blocked and/or might be taxing to your network.

4. Advanced Port Discovery. Discovery will search for open ports, using a faster TCP/IP connection method. Discovery will also perform 2. Discover SSL Certificates, 1. Initial Population of Apps, and 0. Model Device Only.

If your system includes a firewall and you select 4. Advanced Port Discovery, some devices might remain in a pending state (purple icon) for some time after discovery. These devices will achieve a healthy status, but this might take several hours.

5. Deep Discovery. Discovery will use nmap to retrieve the operating system name and version. Discovery will also scan for services running on each open port and can use this information to match devices to device classes. Discovery will search for open ports, using a faster TCP/IP connection method. Discovery will also perform 2. Discover SSL Certificates, 1. Initial Population of Apps, and 0. Model Device Only.

For devices that don't support SNMP, option 5. Deep Discovery allows you to discover devices that don't support SNMP and then align those devices with a device class other than "pingable". Note that option 5. Deep Discovery is compute-intensive.

If SL1 cannot determine the appropriate Device Class, it will assign the device to the Generic SNMP Device Class.

Scan Throttle. Specifies the amount of time a discovery process should pause between each specified IP address (specified in the IP Address/Hostname Discovery List field). Pausing discovery processes between IP addresses spreads the amount of network traffic generated by discovery over a longer period of time. The choices are:

System Default (recommended). Use the value defined in the Behavior Settings page (System > Settings > Behavior).
Disabled. Discovery processes will not pause.
1000 Msec to 10000 Msec. A discovery process will pause for a random amount of time between half the selected value and the selected value.

Port Scan All IPs. For the initial discovery session only, specifies whether SL1 should scan all IP addresses on a device for open ports. The choices are:

System Default (recommended). Use the value defined in the Behavior Settings page (System > Settings > Behavior).
0. Disabled. SL1 will scan only the primary IP address (the one used to communicate with SL1) for open ports.
1. Enabled. SL1 will scan all discovered IP addresses for open ports.

Port Scan Timeout. For the initial discovery session only, specifies the length of time, in milliseconds, after which SL1 should stop trying to scan an IP address for open ports and begin scanning the next IP address (if applicable). Choices are:

System Default (recommended). Use the value defined in the Behavior Settings page (System > Settings > Behavior).
Choices between 60,000 to 1,800,000 milliseconds.

Detection Method & Port. During discovery, SL1 will scan the list of ports selected in this field to determine if the range of devices is up and running and which ports are open on each discovered device. If a device does not respond to SNMP or ICMP, SL1 uses an open port to collect availability data for that device. If you are not sure which ports are used by the range of devices, select the entry Default Method. SL1 will check ICMP (ping), FTP, SSH, Telnet, SMTP, and HTTP ports.

You can use the field at the top of the Detection Method & Port field to filter the list of ports. If you enter an alpha-numeric string in the field, the Detection Method & Port field will include only ports that match the string.

Interface Inventory Timeout (ms). Specifies the maximum amount of time that the discovery processes will spend polling a device for the list of interfaces. After the specified time, SL1 will stop polling the device, will not model the device, and will continue with discovery. The default value is 600,000 ms (10 minutes).

During the execution of this discovery session, SL1 uses the value in this field first. If you delete the default values and do not specify another value in this field, SL1 uses the value in the Global Threshold Settings page (System > Settings > Thresholds).
If you specify a value in this field and do not apply a device template to this discovery session, the Interface Inventory Timeout setting in the Device Thresholds page (Registry > Devices > Device Manager > wrench icon > Thresholds) is set to this value for each discovered device. If there is no device template applied to the discovery session and no value is supplied in this field, SL1 uses the value in the Global Threshold Settings page (System > Settings > Thresholds).

Maximum Allowed Interfaces. Specifies the maximum number of interfaces per devices. If a device exceeds this number of interfaces, SL1 will stop scanning the device, will not model the device, and will continue with discovery. The default value is 10,000.

During the execution of this discovery session, SL1 uses the value in this field first. If you delete the default values and do not specify another value in this field, SL1 uses the value in the Global Threshold Settings page.
If you specify a value in this field and do not apply a device template to this discovery session, the Maximum Allowed Interfaces setting in the Device Thresholds page is set to this value for each discovered device. If there is no device template applied to the discovery session and no value is supplied in this field, SL1 uses the value in the Global Threshold Settings page.

Bypass Interface Inventory. Specifies whether or not the discovery session should discover network interfaces.

Selected. SL1 will not attempt to discover interfaces for each device in the discovery session. For each discovered device, the Bypass Interface Inventory checkbox in the Device Properties page will be selected.
Not Selected. SL1 will attempt to discover network interfaces, using the Interface Inventory Timeout value and Maximum Allowed Interfaces value.

If a device has already been discovered and then is rediscovered through the Discovery Session Editor page, the Bypass Interface Inventory. checkbox in the Device Properties page will retain its previous value, regardless of what is selected in the Discovery Session Editor page.

Discover Non-SNMP Devices. Specifies whether or not SL1 should discover devices that don't respond to SNMP requests.

Selected. SL1 will discover devices that don't respond to the SNMP credentials selected in the SNMP Credentials field. These devices will be discovered as "pingable" devices.
Not Selected. SL1 will not discover devices that don't respond to the SNMP credentials selected in the SNMP Credentials fields.

Model Devices. Determines whether or not the devices that are discovered with this discovery session can be managed through SL1. Choices are:

Enabled. When a device is modeled, SL1 creates a device ID for the device; you can then access the device through the Device Manager page and manage the device in SL1.
Disabled. If a device is not modeled, you cannot access the device through the Device Manager page, and you cannot manage the device in SL1. However, each discovered device will still appear in the Discovery Session logs. For each discovered device, the discovery logs will display the IP address and device class for the device. This option is useful when performing an initial discovery of your network, to determine which devices you want to monitor and manage with SL1. For the amount of time specified in the Device Model Cache TTL (h) field, a user can manually model the device from the Discovery Session window.

DHCP. Specifies whether or not the specified range of IPs and hostnames use DHCP.

Selected. SL1 will perform a DNS lookup for the device during discovery and each time SL1 retrieves information from the device.
Not Selected. SL1 will perform normal discovery.

Device Model Cache TTL (h). Amount of time, in hours, that SL1 stores information about devices that are discovered but not modeled, either because the Model Devices option is not enabled or because SL1 cannot determine whether a duplicate device already exists. The cached data can be used to manually model the device from the Discovery Session window.
Collection Server PID. This field contains a list of all Data Collectors on the network. Select the Data Collector that is local or closet to the devices to be discovered.

For SL1 appliances, only the name of the appliance will appear in this field.

After initial discovery, each device will use the collector group that contains this Data Collector for collection and rediscovery.

Organization. This field contains a list of all organizations defined in SL1. Devices discovered during the discovery session will be assigned to the selected organization.

Make sure you have the desired organization created and selected before running the discovery process. This field assigns all devices and networks in the specified IP range to a single organization. However, you can later assign individual devices and networks to different organizations.

Add Devices to Device Group(s). When SL1 discovers a device in the IP discovery list, that device is added to each selected device group. You can select one or more device groups from a list of device groups in SL1 that have "Discovery" selected in the Visibility field. For more information on device groups, see the Device Groups and Device Templates section.

You can use the field at the top of the Add Devices to Device Group(s) field to filter the list of device groups. If you enter an alpha-numeric string in the field, the Add Devices to Device Group(s) field will include only device groups that match the string.

Apply Device Template. As SL1 discovers a device in the IP discovery list, that device is configured with the selected device template. You can select from a list of all device templates in SL1. For more information on device templates, see the Device Groups and Device Templates section.
Log All. Specifies whether or not the discovery session should use verbose logging. When you select verbose logging, SL1 logs details about each IP address or hostname specified in the IP Address/Hostname Discovery List field, even if the results are "No device found at this address."

Selected. This discovery session will use verbose logging.
Not Selected. This discovery session will not use verbose logging.

Click the Save button to save the discovery session. Close the Discovery Session Editor page.
In the Discovery Control Panel page, click the Reset button. The new discovery session will appear in the Session Register pane.
To launch the new discovery session, click its Queue this Session icon ().
If no other discovery sessions are currently running, the session will be executed immediately. If another discovery session is currently running, your discovery session will be queued for execution.

Viewing Information about Classic Discovery

To view information about a discovery session that has already run:

Go to the Discovery Control Panel page (System > Manage > Classic Discovery).
In the Discovery Control Panel page, in the Session Register, find the discovery session you are interested in. Click its magnifying glass icon ().
The Discovery Session modal page appears. This page provides details on the discovery session.
The Discovery Session page includes an entry for each action performed during the discovery session. Each entry in the Discovery Session page contains:

Date Time. Date and time the action was executed.
Discovery Log Message. When applicable, starts with the IP address of the discovered device. Also includes a description of the action that was executed by the discovery session.

NOTE: If you did not select Auto-Update in the Device Properties page for one or more devices, when the discovery process tries to discover one of those devices, the log will display the message "Auto-Update is disabled and prevents discovery from updating any device properties."

Class Type. The device class for each discovered device. SL1 will determine the device class for each device, even if a device will not be modeled by SL1.
Checkbox. If a device was discovered but not modeled, you can select this checkbox and click the Model button to model the device. If this device is a potential duplicate, the Discovery Sessionpage displays the message "Not modeled, potential duplicate device". If you are certain that the device is not a duplicate, you can choose to model the device.

To save the log to the local computer, go to the Discovery Control Panel page (System > Manage > Classic Discovery), and click the Export icon () for the session.

Creating a New Classic Discovery Session with the "Save As" Button

You can edit an existing discovery session, make one or more changes, and then save the edited discovery session as a new session. The previous session still exists, unedited. To do this:

In the Discovery Control Panelpage (System > Manage > Classic Discovery), in theSession Registry pane, find the discovery session you want to edit. Click its wrench icon (). The Discovery Session Editor page appears.
On the Discovery Session Editor page, you can edit one or more values listed in the Running a Discovery Session section.
Click the Save As button to save the discovery session as a new session. The new session appears in the Discovery Control Panelpage (System > Manage > Classic Discovery).

Editing a Classic Discovery Session

You can edit the parameters of a discovery session in the Discovery Control Panel page. To do this:

Go to the Discovery Control Panel page (System > Manage > Classic Discovery).
Find the discovery session you want to edit. Click its wrench icon ().
The Discovery Session Editor page appears with the values from the previous discovery session. You can edit any of the fields described in the section Running a Discovery Session.
Click the Save button to save your changes. To save the edited discovery session as a new session (the previous session will still exist), click the Save As button. Close the Discovery Session Editor page.
To manually run discovery using the edited session, find the edited session in the Session Register pane and click its Queue this Session icon (). If no other discovery sessions are currently running, the session will be executed immediately. If another discovery session is currently running, your discovery session will be queued for execution.

Scheduling a Classic Discovery Session

You can schedule one-time and recurring re-execution of a selected discovery session. You can use the Schedule Manager page (System > Manage > Classic Discovery > calendar icon) to:

Specify regularly recurring discovery of a specific IP range. This is helpful when you want to monitor an IP range where new devices are frequently added.
Specify one-time re-discovery of a specific IP range. This is helpful when you are aware of hardware or software changes within that IP range that you want SL1 to monitor.

NOTE: Scheduled re-execution of a discovery session is slightly different than SL1's automatic, nightly rediscovery. Nightly rediscovery is applied only to already discovered devices and uses the policies and configuration applied to each device. Re-execution of a discovery session can discover new devices within an IP range and uses only the settings specified in the Discovery Control Panel page.

You can also view and manage all scheduled processes from the Schedule Manager page (Registry > Schedules > Schedule Manager). For more information, see the section on Managing Scheduled Tasks.

Viewing the Schedule Manager

The Schedule Manager page (System > Manage > Classic Discovery > calendar icon) displays the following information about each scheduled or recurring discovery session:

Schedule Summary. Displays the name assigned to the scheduled process.
Schedule Description. Displays a description of the scheduled process.
Event ID. Displays a unique, numeric ID for the scheduled process. SL1 automatically creates this ID for each scheduled process.
sch id. Displays a unique, numeric ID for the schedule. SL1 automatically creates this ID for each schedule.
Context. Displays the area of SL1 upon which the schedule works.
Timezone. Displays the time zone associated with the scheduled process.
Start Time. Displays the date and time at which the scheduled process will begin.
Duration. Displays the duration, in minutes, which the scheduled process occurs.
Recurrence Interval. If applicable, displays the interval at which the scheduled process recurs.
End Date. If applicable, displays the date and time on which the scheduled process will recur.
Last Run. If applicable, displays the date and time the scheduled process most recently ran.
Owner. Displays the username of the owner of the scheduled process.
Organization. Displays the organization to which the scheduled process is assigned.
Visibility. Displays the visibility level for the scheduled process. Possible values are "Private", "Organization", or "World".
Enabled. Specifies if the scheduled process is enabled. Possible values are "Yes" or "No".

To edit a scheduled or recurring discovery session, click its wrench icon () and update the discovery session as needed on the Schedule Editor modal page. (For more information, see the section Defining a Scheduled or Recurring Discovery Session.)

Defining a Scheduled or Recurring Discovery Session

You can schedule a discovery session in SL1 from the Schedule Manager page. SL1 will automatically run the discovery session at the scheduled time.

To define a scheduled or recurring discovery session:

Go to the Schedule Manager page (System > Manage > Classic Discovery > calendar icon).
Click Create. The Schedule Editor modal page appears.
On the Schedule Editor modal page, make entries in the following fields:

Basic Settings

Schedule Name. Type a name for the scheduled process.

Schedule Type. Indicates the scheduled process type (such as Tickets, Reports, or Devices).

Visibility. Select the visibility for the scheduled process. You can select one of the following:

Private. The scheduled process is visible only to the owner selected in the Owner field.

Organization. The scheduled process is visible only to the organization selected in the Organization field.
World. The scheduled process is visible to all users.

Organization. Select the organization to which you want to assign the scheduled process.
Owner. Select the owner of the scheduled process. The default value is the username of the user who created the scheduled process.
Preserve Schedule. Select this checkbox to exclude this schedule from being pruned after expiration.
Description. Type a description of the scheduled process.

Time Settings

Start Time. Click in the field and select the date and time you want the scheduled process to start.

Time Zone. Select the region or time zone for the scheduled start time.

If you want SL1 to automatically adjust for daylight savings time (if applicable), then you must select a named region (such as America/New York) in the Time Zone field. If you select a specific time zone (such as EST) or a specific time offset (such as GMT-5), then SL1 will not automatically adjust for daylight savings time.

Recurrence. Select whether you want the scheduled process to occur once or on a recurring basis. You can select one of the following:

None. The scheduled process occurs only once.
By Interval. The scheduled process recurs at a specific interval.
Every Xth day of the Week. The scheduled process occurs at a monthly interval based on a day of the week. The day of the week displayed in this option matched the day selected in the Start Time field. For example, if you set the Start Time to Thursday, August 5th and that day is the first Thursday of the month, then the recurrence option will be Every 1st Thursday, and the scheduled process will occur monthly on the first Thursday of the month.

If you select By Interval, the following additional fields appear:

Interval. In the first field, enter a number representing the frequency of the scheduled process, then select the time interval in the second field. Choices are Minutes, Hours, Days, Weeks, or Months. For example:

If you specify "6 Hours", then the scheduled process recurs every six hours from the time listed in the Start Date field.

If you specify "10 Days", then the scheduled process recurs every 10 days from the date listed in the Start Date field.
If you specify "2 Weeks", then the scheduled process recurs every two weeks, on the same day of the week as the Start Date.
If you specify "3 Months" the ticket recurs every three months, on the same day of the month as the Start Date.

Recur Until. Specifies when the scheduled process stops recurring. You can select one of the following:

No Limit. The scheduled process recurs indefinitely until it is disabled.
Specified Date. The scheduled process recurs until a specific date and time. If you select Specified Date, you must enter a date and time in the Last Recurrence field.

Last Recurrence. Click in the field and select the date and time you want the scheduled process to stop recurring.

Click Save.

Enabling or Disabling One or More Scheduled Discovery Sessions

You can enable or disable one or more scheduled or recurring discovery sessions from the Schedule Manager page (System > Manage > Classic Discovery > calendar icon). To do this:

Go to the Schedule Manager page (System > Manage > Classic Discovery > calendar icon).

Select the checkbox icon for each scheduled process you want to enable or disable.
Click the Select Action menu and choose Enable Schedules or Disable Schedules.
Click the Go button.

Deleting One or More Scheduled Discovery Sessions

You can delete one or more scheduled or recurring discovery sessions from the Schedule Manager page (System > Manage > Discovery > calendar icon). To do this:

Go to the Schedule Manager page (System > Manage > Classic Discovery > calendar icon).

Select the checkbox icon for each scheduled process you want to delete.
Click the Select Action menu and choose Delete Schedules.
Click the Go button.

Manually Re-Running Classic Discovery for a Dynamic Application

From the Dynamic Applications Manager page, you can manually run the Dynamic Application alignment portion of discovery for all existing devices in the system. That is, you can ask SL1 to check each Dynamic Application and each existing device and align each device with each appropriate Dynamic Application.

For each Dynamic Application you select for re-discovery, SL1 tries to connect to each existing device using the credentials already aligned with each device. If SL1 is able to connect to a device with one of the credentials and can then retrieve the discovery object associated with the Dynamic Application, SL1 will align the Dynamic Application with the device.

To manually run discovery for a single Dynamic Application:

Go to the Dynamic Applications Manager page (System > Manage > Dynamic Applications).
In the Dynamic Applications Manager page, find the Dynamic Application you want to use for network-wide discovery. Click its lightning bolt icon ().
If no other discovery tasks are currently running, SL1 will immediately perform discovery of the entire network, using the selected Dynamic Application.
If other discovery tasks are currently running, SL1 will add the request to the discovery queue.

To manually run discovery for multiple Dynamic Applications:

Go to the Dynamic Applications Manager page (System > Manage > Dynamic Applications).
In the Dynamic Applications Manager page, find the Dynamic Applications you want to use for network-wide discovery. Select the checkbox for each Dynamic Application.
In the Select Actions menu (in the lower right of the page), select DISCOVER Applications.
Click the Go button.
If no other discovery tasks are currently running, SL1 will immediately perform discovery of the entire network, using the selected Dynamic Application.
If other discovery tasks are currently running, SL1 will add the request to the discovery queue.

Manually Re-Running Classic Discovery for a Device

You can manually re-discover a device, using the settings and configuration in the Device Properties page for the device.

Remember that the credentials and settings defined in the Device Properties page override:

Settings in the Behavior Settings page (System > Settings > Behavior).
Credentials and settings in the Discovery Control Panel page (System > Manage > Classic Discovery) from the initial discovery of the device.

SL1 will update the device with the data from the discovery session. The discovery session does not change, overwrite, or affect the existing, historical data associated with the device.

To re-discover a device:

Go to the Device Manager page (Devices > Device Manager).
In the Device Manager page, find the device you want to re-discover. Click its wrench icon ().
In the Device Properties page, click the Rediscover icon ().
If no other discovery tasks are currently running, SL1 will immediately perform discovery of the selected device.
If other discovery tasks are currently running, SL1 will add the request to the discovery queue.