Stuck Discovery Schedule Caused by Syslog ProbesIssue Stuck Discovery Schedule Caused by Syslog ProbesSymptomsDiscovery Status stuck in Active state with Started count greater than Completed count. The Discovery Status's ECC Queue related list contains Syslog probe inputs and/or outputs in Ready state.Facts• Syslog probes are created by invoking ServiceNow Script Include 'Syslog' • There are no scripts or code in an Out of the Box Base System that invoke Script Include 'Syslog' • Customers have to implement custom Business Rules, events, or Orchestration Activities to invoke 'Syslog' to create Syslog probes to integrate with third-party data sources that accept syslog messages such as ArcSight, Splunk, LogLogic, syslog-ng, and others. • Syslog probes are not part of the Discovery application and do not belong in a Discovery Status. ServiceNow Product Documentation - Syslog ProbesReleaseAll ReleasesCauseCreating a Before, After, or Query Business Rule that's triggered and invokes ServiceNow Script Include 'Syslog' in the same transaction as a Discovery Sensor being processed will populate the agent_correlator field of the Syslog Probe's ecc_queue record with the sys_id of the Discovery Status that the Discovery Sensor ran from as the new Syslog Probe has logically been triggered by that Discovery Sensor. ResolutionChange when the Business Rule that was triggered leading to the invocation of 'Syslog' that created the Syslog Probe to 'Async' so that 'Syslog' is invoked in a new/separate transaction. If you don't know what invoked 'Syslog' follow "KB0683765 - Troubleshooting tip - Debug business rule to print StackTrace" to create a temporary debug Before Insert business rule on the ECC Queue [queue_table] with conditions Topic = 'Syslog' AND Agent correlator IS NOT EMPTY and review the resulting StackTrace.