Discovery Credentials - Orphaned cause "SEVERE *** ERROR *** An error occurred while decrypting credentials from instance" - Support and Troubleshooting

Discovery Credentials - Orphaned cause "SEVERE *** ERROR *** An error occurred while decrypting credentials from instance" Description  Discovery did not complete causing the error from the Discovery Log: " SNMP probe timed out. Target is either unreachable or there are no valid credentials for it. "

This issue happens after an instance clone, or clone then upgrade, if the Clone Preserve/Exclude settings do not include all child tables of discovery_credentials.

Discovery Credentials - Orphaned cause "SEVERE *** ERROR *** An error occurred while decrypting credentials from instance" The error message "SNMP probe timed out. Target is either unreachable or there are no valid credentials for it." is only seen in the Discovery log but if the "agent0.log" (MID Server log) is checked, the following exceptions are found:

11/26/18 12:10:22 (830) Worker-Interactive:SNMP-8d6cea70db422300f2a328664a9619c3 DEBUG: Flushing session cache due to credential load. 11/26/18 12:10:22 (939) Worker-Interactive:SNMP-8d6cea70db422300f2a328664a9619c3 SEVERE *** ERROR *** An error occurred while decrypting credentials from instance com.snc.automation_common.integration.exceptions.AutomationIOException: Unable to retrieve data from instance. This MID may not be validated. at com.glide.util.MIDServerInfoPayloadDecrypter.decryptPayload(MIDServerInfoPayloadDecrypter.java:25) at com.service_now.mid.creds.provider.standard.StandardCredentialsProvider.loadCredentials(StandardCredentialsProvider.java:289) at com.service_now.mid.creds.provider.standard.StandardCredentialsProvider.load(StandardCredentialsProvider.java:256) at com.service_now.mid.creds.provider.standard.StandardCredentialsProvider.loadIfNecessary(StandardCredentialsProvider.java:268) at com.service_now.mid.creds.provider.standard.StandardCredentialsProvider.iterator(StandardCredentialsProvider.java:137) at com.service_now.mid.probe.SNMP.getCredentials(SNMP.java:755) at com.service_now.mid.probe.SNMP.attemptSNMPv3(SNMP.java:405) at com.service_now.mid.probe.SNMP.attemptSNMP(SNMP.java:340) at com.service_now.mid.probe.SNMP.probe(SNMP.java:235) at com.service_now.mid.probe.AProbe.process(AProbe.java:96) at com.service_now.mid.queue_worker.AWorker.runWorker(AWorker.java:125) at com.service_now.mid.queue_worker.AWorkerThread.run(AWorkerThread.java:20) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at java.lang.Thread.run(Thread.java:748)

11/26/18 12:10:23 (033) Worker-Interactive:SNMP-8d6cea70db422300f2a328664a9619c3 DEBUG: Flushing session cache due to credential load. 11/26/18 12:10:23 (126) Worker-Interactive:SNMP-8d6cea70db422300f2a328664a9619c3 SEVERE *** ERROR *** An error occurred while decrypting credentials from instance com.snc.automation_common.integration.exceptions.AutomationIOException: Unable to retrieve data from instance. This MID may not be validated. at com.glide.util.MIDServerInfoPayloadDecrypter.decryptPayload(MIDServerInfoPayloadDecrypter.java:25) at com.service_now.mid.creds.provider.standard.StandardCredentialsProvider.loadCredentials(StandardCredentialsProvider.java:289) at com.service_now.mid.creds.provider.standard.StandardCredentialsProvider.load(StandardCredentialsProvider.java:256) at com.service_now.mid.creds.provider.standard.StandardCredentialsProvider.loadIfNecessary(StandardCredentialsProvider.java:268) at com.service_now.mid.creds.provider.standard.StandardCredentialsProvider.iterator(StandardCredentialsProvider.java:137) at com.service_now.mid.probe.SNMP.getCredentials(SNMP.java:755) at com.service_now.mid.probe.SNMP.attemptSNMPv1_v2c(SNMP.java:361) at com.service_now.mid.probe.SNMP.attemptSNMP(SNMP.java:346) at com.service_now.mid.probe.SNMP.probe(SNMP.java:235) at com.service_now.mid.probe.AProbe.process(AProbe.java:96) at com.service_now.mid.queue_worker.AWorker.runWorker(AWorker.java:125) at com.service_now.mid.queue_worker.AWorkerThread.run(AWorkerThread.java:20) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at java.lang.Thread.run(Thread.java:748) The error is encountered every time the credentials are being loaded in the system and that happens when Discovery runs.

Cause Orphaned records are found in the [discovery_credentials] table.

At the end of 2021, this is the only open clone engine defect for the discovery credential table: PRB1542851 A clone can corrupt the discovery_credentials table on the target instance, leaving orphan/ghost records with a class that no longer exists, preventing MID Server using all credentials

The MID Server also has a problem opened to avoid bad records like this breaking the MID Server, but this is not fixing the causes or the bad records. PRB1323710 Credentials fail to synchronize to MID server whenever the instance has an invalid credential

This similar cause is fixed, although had caused a lot of cases in the past, specifically for the credential table, but other TPC extended tables still have this issue, and links to other solutions. PRB1305469 Excluding table-per-class (TPC) extended tables from a clone can cause orphaned Discovery Credentials with the 'Record not found' error when trying to open them

Verify this by navigating to Discovery > Credentials, opening the credentials, and checking if these show "Record not found". That would be the symptom that the credential record is an orphan record. Resolution To find orphan credentials, run the script from KB0716609 , changing 'sys_metadata' in the first line of script to be 'discovery_credentials' like

findOrphans('discovery_credentials', null, false);

To then delete orphan credentials, also change false to true in the same line like

findOrphans('discovery_credentials', null, true);

General steps for how this kind of issue with other causes might be debugged are in: KB1001129 Debugging "Failed to retrieve credentials and affinities" errors when running probes in MID Server, and GetMIDInfo getCredentials in general Additional Information Related to:

KB0786475 MID Servers and Clones KB0717208 / PRB1305469 - "Excluding table-per-class (TPC) extended tables from a clone can cause orphaned Discovery Credentials with the 'Record not found' error when trying to open them" . KB0748823 / PRB1342894 - An error occurred while decrypting credentials from instance - Creating OAuth 2.0 credential results in no credentials being retrieved by the MID server, and Probes will no longer be able to use them