[ACC] Understanding the difference between Check Definition, Check Instance, and Check Type - Support and Troubleshooting

[ACC] Understanding the difference between Check Definition, Check Instance, and Check Type .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Table of Contents Overview Check Definition Check Instance Check Type Overview This article aims to explain the difference between Check Definitions, Check Instances, and Check Types. Check Definition Check Definition [sn_agent_check_def] is the base definition of a Check - like a blueprint that defines the command to execute and the default configuration options. Check Definition form page - Command to execute - Name and description - Default scheduling information - Required configuration files and assets - Default Parameters Example: "Enhanced Discovery" Check Definition Please note: Check Definitions are used for on-demand check executions, such as UI Actions (e.g., Grab Agent Config), and are used as the default base when creating a new policy. Check Instance Check Instance [sn_agent_check] is a configured instance of a Check with specific parameter values and settings, associated with a Monitoring Policy. Check Instances are created when defining Agent Client Collector Policies: Create a new Agent Client Collector policy A check instance Contains: - References to parent Check Definition, Monitoring Policy and Check Type - Specific parameter values (e.g., log_level=debug) - Customized scheduling (e.g., every 5 minutes instead of default 15) - May have a different name than the Check Definition Example: The "Enhanced Discovery Policy" policy contains an "Enhanced Discovery" check instance, which is a copy of the "Enhanced Discovery" check definition. Changes made to the check definition are not propagated automatically to the check instance - likewise, a configured check instance will not change the original check definition. Please note: If making changes to a check for testing or debugging purposes - such as to increase the log level of a check , it is common to add a check instance to a test policy. However, not all checks should be tested via policy - many checks are designed only for on-demand execution. In this case, consider creating a copy of the existing Check Definition so that existing functionality relying on the check definitions is not impacted (such as UI Actions, scheduled jobs). Check Type Check Type [sn_agent_check_type] defines how check results are processed after execution. Typically, the check type defines: - Instance-side processing scripts - MID Server processing scripts Note: Instance and MID scripts are optional and are not mutually exclusive. Most check types would use only a MID or Instance script, but this is not a strict requirement - some check types have neither, and some have both. Typically the Instance-side processing scripts describe the scripts used to process a check result on the instance - such as the discovery check payloads which are returned to the instance in the ECC Queue. Likewise, the MID Server processing scripts determine how a check result may be processed, such as the "Events" Check Type which is used to send events directly to the instance via the inbound event API (and therefore bypasses the ECC queue). Example: The "Enhanced Discovery" check definition uses "Enhanced Discovery" Check Type.