View and understand discovery results and logs - BlueCat Integrity - 26.1.0

Address Manager Administration Guide
ft:locale
en-US
Product name
BlueCat Integrity
Version
26.1.0

For the selected task, the task-name page displays links to the generated discovery results and logs, along with their associated details. The discovery results and logs vary for each discovery method, depending on how discovery is performed and what the devices expose.

The number of results displayed depends on the maximum number of results the task is allowed to store. You specify this value in the Max discovery results field when creating the task.

By default, each result entry in the table has the following attributes:

Column Description
Name The auto-generated name of the discovery result.

Selecting the result name opens the expanded details section, showing the complete discovery result. For more details on how to understand and interpret the discovery results, refer to About discovery results.

Creation time The time at which the result entry was created.

The date is displayed in the format MM DD, YYYY and time is displayed in the format hh:mm:ss AM/PM.
Duration The time taken to complete the task.
Log The name of the discovery log generated for the result.

Selecting the log name opens the expanded details section, showing the complete discovery logs generated for the result.
Error The name of the error logs generated for the result, if available. If no error logs are generated, this column is blank.

Selecting the error log name will open the expanded details section, showing the complete error logs generated for the result.
Exception The name of the exception logs generated for the result. If no exception logs are generated, this column is blank.

Selecting the exception log name will open the expanded details section, showing the complete exception logs generated for the result.
Actions (vertical ellipsis icon)

Actions you can perform on the selected task result: view detailed results, delete results, and download results as a zip file.

About discovery results

To view detailed discovery results for a task, select the result name in the task-name page, or select the vertical ellipsis icon for a result entry, then select View details. The expanded details section opens, displaying the detailed result.

You can also download these results (in JSON) as a zip file by selecting the checkbox for the result and then selecting Actions > Download. Alternatively, select the vertical ellipsis icon for the result, then select Download.

The network discovery results are displayed in a JSON file which consists of sets of objects representing the devices and associated information that Network Discovery has found in a network. The following example is a partial result file of an SNMP discovery. The general format of the discovery results for all network discovery types are the same. The example discovery result consists of some top-level objects representing a router device and a few host devices. (A full set of discovery results will consist of more objects of the types shown in this partial discovery results example). Router and switch devices may have many other devices connected to them. The connected devices are contained in the “addresses” object within the top-level device object. Each item in the “addresses” list represents a connected device with information about it (such as the device IP address and other attributes as shown for the router in the example). Host devices only have a single IP address assigned to them and will not have an “addresses” object. The following is one example of the JSON object for a host device:
{"address":"172.16.2.4", "fqdn":"172.16.2.4", "id":31, "type":"HOST", "parentId":0},
The IP address, device, and other associated information in the discovery results can by imported into Address Manager using the automatic reconciliation feature; you can also choose to perform reconciliation manually. During automatic reconciliation, Address Manager will automatically create blocks and networks if necessary to contain the IP addresses of devices found in the discovery results. Address Manager device objects with the attributes of the devices found in the results are also automatically created during reconciliation and associated with their corresponding IP addresses. Then, you can view the reconciled information in the Address Manager UI pages.
Note: While the following examples shows some of the various data fields that can be possibly discovered, BlueCat Address Manager does not use all the discovered data for reconciliation.
Example: SNMP discovery result
The following example shows an SNMP discovery result for a router:
[
{"id":1, "parentId":0, "address":"192.0.2.10", "name":"Router", "description":"Cisco IOS Software [Dublin], Virtual XE Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 17.11.1a, RELEASE SOFTWARE (fc3)Technical Support: http://www.cisco.com/techsupportCopyright (c) 1986-2023 by Cisco Systems, Inc.Compiled Wed 05-Apr-23 06:54", "location":"", "vendor":"Cisco", "type":"ROUTER", "vendorId":9, 
	"device-addresses":["198.51.100.10","198.51.100.11","192.0.2.196"], 
	"interfaces":[
		{"ifIndex":1, "connector":"true", "name":"Gi1", "alias":"", "speed":1000000000, "hispeed":0},
		{"ifIndex":2, "connector":"true", "name":"Gi2", "alias":"", "speed":1000000000, "hispeed":0},
		{"ifIndex":3, "connector":"true", "name":"Gi3", "alias":"", "speed":1000000000, "hispeed":0},
		{"ifIndex":4, "connector":"true", "name":"Gi4", "alias":"", "speed":1000000000, "hispeed":0},
		{"ifIndex":5, "connector":"false", "name":"Nu0", "alias":"", "speed":4294967295, "hispeed":0}], 
	"network-interfaces":[
		{"ifIndex":1, "description":"GigabitEthernet1", "physAddress":"500000010000", "ifType":6},
		{"ifIndex":2, "description":"GigabitEthernet2", "physAddress":"500000010001", "ifType":6},
		{"ifIndex":3, "description":"GigabitEthernet3", "physAddress":"500000010002", "ifType":6},
		{"ifIndex":4, "description":"GigabitEthernet4", "physAddress":"500000010003", "ifType":6},
		{"ifIndex":5, "description":"Null0", "physAddress":"", "ifType":1}], 
	"vlans":[
		{"id":"1.1", "name":"default", "ifIndex":-1}], 
	"mac-info":[], 
	"addresses":[
		{"address":"198.51.100.10", "hardware":"500000010002", "ifIndex":3, "originalIfIndex":3},
		{"address":"198.51.100.11", "hardware":"500000010001", "ifIndex":3, "originalIfIndex":3},
		{"address":"192.0.2.1", "hardware":"001C73000099", "ifIndex":1, "originalIfIndex":1},
		{"address":"192.0.2.25", "hardware":"005056A88927", "ifIndex":1, "originalIfIndex":1},
		{"address":"192.0.2.77", "hardware":"005056A8387D", "ifIndex":1, "originalIfIndex":1},
		{"address":"192.0.2.21", "hardware":"005056A855D5", "ifIndex":1, "originalIfIndex":1},
		{"address":"192.0.2.196", "hardware":"500000010000", "ifIndex":1, "originalIfIndex":1},
		{"address":"192.0.2.71", "hardware":"005056A81682", "ifIndex":1, "originalIfIndex":1},
		{"address":"192.0.2.41", "hardware":"005056A81294", "ifIndex":1, "originalIfIndex":1},
		{"address":"192.0.2.70", "hardware":"005056A81CB0", "ifIndex":1, "originalIfIndex":1},
		{"address":"192.0.2.40", "hardware":"005056A8621A", "ifIndex":1, "originalIfIndex":1},
		{"address":"192.0.2.61", "hardware":"005056A80E98", "ifIndex":1, "originalIfIndex":1}], 
	"route-tables":{
		"routing":[]
		},
	"networks":[
		{"network":"198.51.100.0/24", "ifIndex":"3", "destination":"198.51.100.0", "nextHop":"0.0.0.0", 
			"hosts":[
				{"address":"198.51.100.10", "hardware-address":"500000010002", "type":"HOST", "if-index":"3"},
				{"address":"198.51.100.11", "hardware-address":"500000CB38C2", "type":"HOST", "if-index":"3"}]},
		{"network":"192.0.2.0/24", "ifIndex":"1", "destination":"192.0.2.0", "nextHop":"0.0.0.0", 
			"hosts":[
				{"address":"192.0.2.1", "hardware-address":"001C73000099", "type":"HOST", "if-index":"1"},
				{"address":"192.0.2.25", "hardware-address":"005056A88927", "type":"HOST", "if-index":"1"},
				{"address":"192.0.2.77", "hardware-address":"005056A8387D", "type":"HOST", "if-index":"1"},
				{"address":"192.0.2.21", "hardware-address":"005056A855D5", "type":"HOST", "if-index":"1"},
				{"address":"192.0.2.196", "hardware-address":"500000010000", "type":"HOST", "if-index":"1"},
				{"address":"192.0.2.71", "hardware-address":"005056A81682", "type":"HOST", "if-index":"1"},
				{"address":"192.0.2.41", "hardware-address":"005056A81294", "type":"HOST", "if-index":"1"},
				{"address":"192.0.2.70", "hardware-address":"005056A81CB0", "type":"HOST", "if-index":"1"},
				{"address":"192.0.2.40", "hardware-address":"005056A8621A", "type":"HOST", "if-index":"1"},
				{"address":"192.0.2.61", "hardware-address":"005056A80E98", "type":"HOST", "if-index":"1"}]}]
},

{"address":"0.0.0.0", "message":"the end"}
]
The following table explains the various fields shown in the example SNMP discovery result:
Field/Line Description 

{"id":1, "parentId":0, "address":"192.0.2.10", "name":"Router", "description":"Cisco IOS Software [Dublin], Virtual XE Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), 
Version 17.11.1a, RELEASE SOFTWARE (fc3)Technical Support: http://www.cisco.com/techsupportCopyright (c) 1986-2023 by Cisco Systems, Inc.Compiled Wed 05-Apr-23 06:54",
 "location":"", "vendor":"Cisco", "type":"ROUTER", "vendorId":9, 
	"device-addresses":["198.51.100.10","198.51.100.11","192.0.2.196"],
General information of the discovered device. The key attributes include:
  • id – The unique identifier automatically assigned to the discovered object within the discovery result.
  • parentId – The ID of the parent object associated with the discovered child object.
    Note: Although this field is populated in discovery results, it is not currently maintained.
  • address – The primary IP address Network Discovery uses to identify and communicate with the device.
  • name – The logical name of the device.
  • description – Compiled from the device and typically contains the device name, vendor, location, version, and software information.
  • device-addresses – The IP addresses used by the device.

If the device does not expose specific data, the corresponding field in the discovery result is empty (that is, the field displays "" "").
"device-addresses": ["198.51.100.10","198.51.100.11","192.0.2.196"] The primary IP addresses used to identify and communicate with the discovered network devices.
"interfaces":[ {"ifIndex":1, "connector":"true", "name":"Gi1", "alias":"", "speed":1000000000, "hispeed":0}, Interface details exposed by the device. The key attributes include:

  • ifIndex – Interface index, which is a unique identifier for the interface.

  • connector – True indicates a physical port.

  • name – Interface name (configured to act as VLAN or physical LAN).

  • speed / hispeed – Interface speed (in bps).
"network-interfaces":[ {"ifIndex":1, "description":"GigabitEthernet1", "physAddress":"500000010000", "ifType":6}, Additional attributes of the same network interfaces . The key attributes include:

  • ifIndex – Interface index, which is a unique identifier for the interface.

  • physAddress – MAC address of the interface.

  • description – Interface description.

  • ifType – Interface type (Ethernet, loopback, etc.).
"vlans":[ {"id":"1.1", "name":"default", "ifIndex":-1}], VLANs configured on the device (if any) and exposed for discovery. The key attributes include:

  • id – VLAN identifier.

  • name – VLAN name.

  • ifIndex – Associated interface index (or -1 if not maintained).
"mac-info": [] MAC address table entries.

This field may be empty (that is, the field displays [ ]) for various reasons,including cases where the device does not expose MAC address details or the device is not a Layer 2 switch.
"addresses":[ {"address":"198.51.100.10", "hardware":"500000010002", "ifIndex":3, "originalIfIndex":3}, The IP addresses assigned to device interfaces and the MAC address mapped to these IP addresses. The key attributes include:

  • address – IPv4 or IPv6 address of the device interface.

  • hardware – MAC address of the device interface.

  • ifIndex – Interface index associated with the IP address.
"route-tables":{ "routing":[] }, The routing information known to the device.

This field may be empty (that is, the field displays [ ]) for various reasons, including cases where the device does not expose routing table information or the device is not a router.
"networks":[ {"network":"198.51.100.0/24", "ifIndex":"3", "destination":"198.51.100.0", "nextHop":"0.0.0.0", "hosts":[ {"address":"198.51.100.10", "hardware-address":"500000010002", "type":"HOST", "if-index":"3"}, {"address":"198.51.100.11", "hardware-address":"500000CB38C2", "type":"HOST", "if-index":"3"}]}, Networks and subnets discovered through interface and routing information. The key attributes include:

  • network – Subnet (CIDR notation)

  • ifIndex – Interface index associated with the network.

  • destination and nextHop – Routing information.

  • hosts – End hosts discovered on this network.
{ "address": "0.0.0.0", "message": "the end" } Indicates the end of discovery output (not part of actual discovered data).
Example: SSH discovery result

The following example shows an SSH discovery result for a router:

[
  {
    "address": "192.0.2.131",
    "fqdn": "host131.bluecat.com"
    "type": "HOST",
    "id": 2,
    "parent-id": 1,
  },
  {
    "address": "192.0.2.60",
    "fqdn": "192.0.2.60",
    "type": "HOST",
    "id": 3,
    "parent-id": 1,
  },
  {
    "id": 1,
    "parentId": 0,
    "type": "ROUTER",
    "vendorId": "0",
    "vendor": "Synthetic_SSH_Discovered_Device",
    "address": "192.0.2.10",
    "name": "asa_0",
    "location": "",
    "description": "Cisco Adaptive Security Appliance Software Version 9.18(1)\\r\\nSSP Operating System Version 2.12(0.31)\\r\\nDevice Manager Version 7.18(1)\\r\\n",
    "device-address": [],
    "vlans": [],
    "mac-info": [],
    "addresses": [
      {
        "ifIndex": 1,
        "hardware": "00-11-22-AA-BB-CC",
        "address": "192.0.2.131",
        "originIfIndex": 1,
        "type": "arpEntry"
      }
    ],

    "network-interfaces": [
      {
        "ifIndex": 1,
        "description": "GigabitEthernet0/0 (outside)"
      }
    ],

    "networks": [
      {
        "network": "192.0.2.0/24",
        "ifIndex": 1,
        "hosts": [
          {
            "address": "192.0.2.131",
            "type": "HOST"
          }
        ]
      }
    ]
  }
]
The following table explains the various fields shown in the example SSH discovery result:
Field/Line Description 
  {
    "address": "192.0.2.131",
    "fqdn": "host131.bluecat.com"
    "type": "HOST",
    "id": 2,
    "parent-id": 1,
  },
  {
    "address": "192.0.2.60",
    "fqdn": "192.0.2.60",
    "type": "HOST",
    "id": 3,
    "parent-id": 1,
  },
 Hosts identified from the seed device. The key attributes include:

  • address – The IPv4 or IPv6 address of the host.

  • fqdn – The Fully qualified domain name (if available).

  • type – The object type (HOST)

  • id – The unique identifier automatically assigned to the discovered object within the discovery result.

  • parent id – The ID of the object to which the host belongs. 

"id": 1,
    "parentId": 0,
    "type": "ROUTER",
    "vendorId": "0",
    "vendor": "Synthetic_SSH_Discovered_Device",
    "address": "192.0.2.10",
    "name": "asa_0",
    "location": "",
    "description": "Cisco Adaptive Security Appliance Software Version 9.18(1)\\r\\nSSP Operating System Version 2.12(0.31)\\r\\nDevice Manager Version 7.18(1)\\r\\n",
    "device-address": [],
    "vlans": [],
    "mac-info": [],
 General information of the seed device selected for SSH discovery. The key attributes include:

  • id – The unique identifier automatically assigned to the discovered object within the discovery result.

  • parentId – The ID of the parent object associated with the discovered child object.

  • address – The management IP address used for SSH connection.
  • name – The logical name of the device.
  • description – Compiled from the device and typically contains the device name, vendor, location, version, and software information.
  • device-addresses – The IP addresses used by the device.

If the device does not expose specific data, the corresponding field in the discovery result is empty. 

 "addresses": [
      {
        "ifIndex": 1,
        "hardware": "00-11-22-AA-BB-CC",
        "address": "192.0.2.131",
        "originIfIndex": 1,
        "type": "arpEntry"
      }
    ]
 IP address to MAC address mapping, as obtained from the device's ARP table. 
"network-interfaces": [
  {
    "ifIndex": 1,
    "description": "GigabitEthernet0/0 (outside)",
    "physAddress": "00-11-22-33-44-55"
  }
]
 The physical and logical interfaces on the seed device. 

    "networks": [
      {
        "network": "192.0.2.0/24",
        "ifIndex": 1,
        "hosts": [
          {
            "address": "192.0.2.131",
            "type": "HOST"
          }
        ]
 The subnets associated with the seed device and the hosts detected within these subnets.
Example: VMware discovery result

The following example shows a VMware discovery result:

[
  {
    "id": 1,
    "parentId": 0,
    "name": "TestEsxi",
    "type": "HOST_SYSTEM",

    "addresses": [
      { "address": "192.0.2.101", "hardware": "00:0C:29:C1:00:A8" },
      { "address": "fe80::20c:29ff:fec1:a8", "hardware": "00:0C:29:C1:00:A8" },
      { "address": "192.0.2.100", "hardware": "00:0C:29:D5:BB:B9" }
    ],

    "networks": [
      {
        "network": "198.51.100.0/24",
        "ifIndex": -1,
        "destination": "198.51.100.0",
        "nextHop": "0.0.0.0",
        "hosts": [
          { "address": "198.51.100.4", "type": "HOST" }
        ]
      },
      {
        "network": "192.0.2.0/24",
        "ifIndex": -1,
        "destination": "192.0.2.0",
        "nextHop": "0.0.0.0",
        "hosts": [
          { "address": "192.0.2.100", "type": "HOST" },
          { "address": "192.0.2.101", "type": "HOST" }
        ]
      }
    ]
  },

  { "address": "0.0.0.0", "message": "the end" }
]
The following table explains the various fields shown in the example VMware discovery result:
Field/Line Description 
{
  "id": 1,
  "parentId": 0,
  "name": "TestEsxi",
  "type": "HOST_SYSTEM"
}
 The ESXi host which is the starting point of discovery (identified by parentId being 0). 
 "addresses": [
      { "address": "192.0.2.101", "hardware": "00:0C:29:C1:00:A8" },
      { "address": "fe80::20c:29ff:fec1:a8", "hardware": "00:0C:29:C1:00:A8" },
      { "address": "192.0.2.100", "hardware": "00:0C:29:D5:BB:B9" }
    ],
The IPv4 addresses (192.0.2.x in this example), IPv6 addresses (fe80::… in this example), and MAC addresses assigned to the ESXi host. 
 "networks": [
      {
        "network": "198.51.100.0/24",
        "ifIndex": -1,
        "destination": "198.51.100.0",
        "nextHop": "0.0.0.0",
        "hosts": [
          { "address": "198.51.100.4", "type": "HOST" }
        ]
      },
      {
        "network": "192.0.2.0/24",
        "ifIndex": -1,
        "destination": "192.0.2.0",
        "nextHop": "0.0.0.0",
        "hosts": [
          { "address": "192.0.2.100", "type": "HOST" },
          { "address": "192.0.2.101", "type": "HOST" }
        ]
      }
    ]
 The subnets associated with the ESXi host. The key attributes include:

  • network – The subnet (in CIDR format) to which the host is connected.

  • destination and nextHop – The IP address of the destination and next hop.

  • hosts – The hosts detected within the subnets. (networks).

  • ifIndex – Interface index, which is a unique identifier for the interface. If the interface index is not applicable or not exposed, the corresponding value in the discovery result is -1.

{ "address": "0.0.0.0", "message": "the end" } Indicates the end of discovery output (not part of actual discovered data).

About discovery logs

Network Discovery & Visibility generates three types of logs for each discovery run: Discovery logs, error logs (if available), and exception logs (if available). Each line in the log file contains the following fixed fields:

Field Description
Time The time the log message was generated.
Message Type A one-character field indicating the type of log message. The possible values are:
  • P – Progress message (how discovery is progressing)
  • E – Error message (device errors and program errors)
  • W – Warning message (useful for programmers' awareness and typically not for end-users)
  • . (dot) – Debug message (to identify anomalous data reported about a device)
Component The component reporting the log message.
Address The IPv4 or IPv6 address associated with the log message. The possible values are host address, subnet address, or noAddr when the log message is general (about the system) such as startup messages.
Message The log message.
Note: Progress and Error messages begin with a number to ensure that such messages are easily identified even when translated to other languages.

  • SNMP discovery logs: SNMP discovery logs show SNMP communication with network devices, including connection attempts, authentication results (success or failure), OID queries, and data retrieval, among others. Some of the most common issues for which you would refer to SNMP logs are authentication failures, timeouts or unreachable devices, missing or unsupported MIB data, and incomplete topology or device information.

  • VMware discovery logs: VMware discovery logs show interactions with the vCenter API, including authentication attempts, API requests and responses, and object retrieval (hosts, clusters, and virtual machines), among others. Some of the most common issues for which you would refer to VMware discovery logs are authentication failures, insufficient API permissions, missing or incomplete objects, API timeouts, and connectivity issues.

  • SSH discovery logs: SSH discovery logs show SSH connection attempts, authentication results (success or failure), and device type detection, among others. Some of the most common issues for which you would refer to SSH logs are connection and authentication failure, unsupported command outputs, and insufficient privileges.

Additional actions you can perform

In addition to viewing the discovery results and logs, you can perform the following actions from the task-name page:

  • Delete one or more task results—in the expanded details section for the task result, select Delete. Alternatively, select the vertical ellipsis icon for the task result, then select Delete. A confirmation window appears asking you to confirm the deletion. Once you confirm by selecting Delete, the task result is permanently deleted.
    Note: Logs cannot be deleted.
  • Similar to other tables in Integrity, you can search for specific results in the table by name, sort and customize the table, as well as filter, refresh, and download table data.