Discovery | SSH Command Results returned with additional preceding line starting with 'Last login' cause both Discovery and Service Mapping SSH based Patterns to failIssue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Issue: Some devices such as Linux Servers may be configured to display Last login with timestamp additional line when SSH commands are executed remotely. Discovery and Service Mapping Patterns don't parse this first line and it will be set to the value in any variable that the command result is set to. If this variable is used in later steps, like a new command or a directory path, then the 'Last login: +timestamp' will be used, causing those steps to fail. Expected Behavior: 1. The Pattern Executes an SSH Command 2. The output from the SSH Command is returned with no 'Last login: + timestamp' line preceding it. 2023-11-26 09:06:28: Command result:/u01/app/oracle/product/12.1.0.2/dbhome_1/network/admin/samples/tnsnames.ora 3. The Command result is set to a temporary variable with value: "/u01/app/oracle/product/12.1.0.2/dbhome_1/network/admin/samples/tnsnames.ora" 4. The value in the temporary variable is used in a later Pattern step to get more data that the Pattern needs for Discovery. 2023-11-26 09:06:27: Executing SSH command as superuser: cat "/u01/app/oracle/product/12.1.0.2/dbhome_1/network/admin/samples/tnsnames.ora"5. The expected data is returned successfully 2023-11-26 09:06:28: Command result: # This file contains the syntax information for # the entries to be put in any tnsnames.ora file # The entries in this file are need based. # There are no defaults for entries in this file # that Sqlnet/Net3 use that need to be overridden Actual Behavior: 1. The Pattern Executes an SSH Command 2. The output from the SSH Command is returned with 'Last login: + timestamp' line preceding it. 2023-11-26 09:06:28: Command result: Last login: Sat Nov 25 10:18:13 UTC 2023/u01/app/oracle/product/12.1.0.2/dbhome_1/network/admin/samples/tnsnames.ora 3. The Command result is set to a temporary variable with value: "Last login: Sat Nov 25 10:18:13 UTC 2023" 4. The value in the temporary variable is used in a later Pattern step to get more data that the Pattern needs for Discovery. 2023-11-26 09:06:27: Executing SSH command as superuser: cat "Last login: Sat Nov 25 10:18:13 UTC 2023" 5. The Command fails with "No such file or directory found" 023-11-26 09:06:28: Command result:cat "Last login: Sat Nov 25 10:18:13 UTC 2023": No such file or directory Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Any Release - Discovery and Service Mapping SSH based Patterns Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Device Configuration: UNIX/Linux/SSH Discovery based device is configured to return Last login + additional information preceding the result of any SSH Command executed on the system. Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } MID Server Property mid.sa.ssh.remove_first_line_regex can be set with a Regular Expression value to match on the first line of an SSH Command Result and remove that first line when matched. This property doesn't exist on a baseline instance and needs to be created and configured on the MID Server Properties [ecc_agent_property] table. Procedure 1. Navigate to All > MID Server > Properties 2. Click New 3. Fill in the below fields: Name = mid.sa.ssh.remove_first_line_regexValue = Last.login.* 4. Leave the MID Server field blank to apply the property to ALL MID Servers, or to set the MID Server field to a particular MID Server, select that MID Server 5. Save the property/record 6. Restart the MID Server to ensure the properties sync with the instance Related Links<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Link to Product Documentation on MID Server Property mid.sa.ssh.remove_first_line_regex https://docs.servicenow.com/bundle/vancouver-it-operations-management/page/product/service-mapping/reference/mid-server-properties-service-mapping.html