File Based DiscoverySummaryFile-based Discovery helps you identify what software is running on your Windows and UNIX servers and devices. You can then manage and maintain records of your software licenses, check for unlicensed files, detect forbidden or damaged files, and help evaluate any threats from unwanted files. This information is stored in the File Information [cmdb_file_information] table with a reference to the CI of the server. File-based Discovery is triggered in the exploration phase of normal Discovery. File-based Discovery probes execute a scan searching for specific file extensions or file names in paths that you configure. The resulting file information is returned in the probe payload. The sensor attempts to match the discovered files with installed software, using the file name, size, and version returned by the probe. For more information see document File-based Discovery. If SAMP is active on the instance, File-based Discovery creates or updates identified software products in the Software Installation [cmdb_sam_sw_install] table and updates the licenses of matched software packages. Without SAMP, no software records are created and only the file information goes into the File Information [cmdb_file_information] table. Required Plugin The File-based Discovery [com.snc.discovery.file_based_discovery] plugin is required for file signature filtering. Configuration Once the File-based Discovery plugin is active, configuration will be performed in the Discovery Configuration Console, under "Discovery Definition > Configuration Console". Script includes DiscoveryFBDConditionsFileBasedDiscoveryUtils Properties Note: Use the Configuration Console to update these properties. NameDescription (All Controlled via Configuration Console)glide.discovery.file_discovery.enabledUse this flag to turn on/off File Based Discovery which will attempt to discover software on Unix and Windows computers via file signatures.glide.discovery.file_discovery.path.windowsA list of Windows file paths to scan for file signatures.glide.discovery.file_discovery.ignore_path.windowsA list of Windows file paths to ignore when scanning for file signatures.glide.discovery.file_discovery.blacklist.windowsA list of Windows file extensions to ignore during file discovery scan.glide.discovery.file_discovery.wildcard.windowsAny file in the scan path that matches an extension in this list will be discovered. This is in addition to the list of files that are already discovered by default. Adding to this list might impact performance.glide.discovery.file_discovery.skip_hidden_folders.windowsUse this flag to turn on/off whether File Based Discovery will search inside hidden folders for files on Windows devices.glide.discovery.file_discovery.use_rp_path.windowsDetermines whether to use running process paths during Windows FBD.glide.discovery.file_discovery.scan_swid.windowsScan for .swidtag files and use the information therein to create software install records (when SAMP activated).glide.discovery.file_discovery.sleeptime.windowsLength of time to sleep in milliseconds during each throttling interval while scanning for Windows files. Default is 10000.glide.discovery.file_discovery.throttle.windowsNumber of files to scan on windows before sleeping. Default is 500.glide.discovery.file_discovery.skip_hidden_folders.unixUse this flag to turn on/off whether File Based Discovery will search inside hidden folders for files on Unix devices.glide.discovery.file_discovery.use_rp_path.unixDetermines whether to use running process paths during Unix FBD.glide.discovery.file_discovery.ignore_path.unixA list of Unix file paths to ignore when scanning for file signatures.glide.discovery.file_discovery.path.linuxA list of Unix file paths to scan for file signatures.glide.discovery.file_discovery.frequencyDefines the frequency for running file-based Discovery on a CI. After Discovery runs and returns file information for a CI, it will not execute file-based Discovery again on that target until the interval has expired. Choosing a frequency higher than "Monthly" is not recommended due to performance considerations.glide.discovery.file_discovery.max_file_numberNumber of files that can be discovered per target machine. Default is 100000. Probes Triggered By https://<instance_name>.service-now.com/discovery_sensor_probe_conditional_list.do?sysparm_query=condition_scriptLIKEDiscoveryFBDConditions File-based Discovery Filtering Flow Issues Error: FBD is disabled via system property but is being triggered one last time to clean up any remaining FBD results on the target.Cause: glide.discovery.file_discovery.enabled = false.Solution: Navigate to "Discovery Definition > Configuration Console" and enable file based discovery. Error: Not triggering FBD since its probes have not been built (CDS content has probably not been synched yet)Cause: Properties file_discovery.unix_filename.timestamp and file_discovery.windows_filename.timestamp under table discovery_private_properties have value of 1970-01-01 12:00:00, which means the CDS content has not been downloaded yet.Solution: By default, the content is downloaded once every week. Navigate to table cds_client_schedule and search for records where field "table" value are one of samp_file_name, samp_file_map, samp_file_set . Click on the records and then on "Execute Now" to trigger an immediate download from the CDS. Note: It can take a while for the content do be fully downloaded. Navigate to "System Logs > Outbound HTTP Requests" to review the download of the content and ensure that the "Response status" is 200 for http logs where the "URL hostname" is sncdataservices.service-now.com. Error: Not triggering FBD since interval has not passedCause: Interval since last FBD has not passed.Solution: Navigate to "Discovery Definition > Configuration Console" and configure the interval accordingly. Also see File-based Discovery issue resolution.Related LinksRun File-based DiscoveryFile-based Discovery tablesFile Signature Normalization