ServiceNow MSSql DB On Windows Pattern Troubleshooting - Support and Troubleshooting

ServiceNow MSSql DB On Windows Pattern Troubleshooting Summary .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } :root { color-scheme: light; --blue:#005baa; --blue-dark:#173f67; --ink:#172033; --muted:#5b6678; --line:#d6dee8; --surface:#fff; --page:#f3f6fa; --red:#b42318; --amber:#9a6700; --green:#087443; } * { box-sizing:border-box; } html { scroll-behavior:smooth; } body { margin:0; padding:24px; background:var(--page); color:var(--ink); font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif; line-height:1.55; } .kb-page { max-width:980px; margin:0 auto; } .kb-hero { background:var(--blue); color:#fff; padding:28px 32px; border-radius:8px; margin-bottom:24px; } .kb-eyebrow { margin:0 0 6px; font-size:11px; letter-spacing:1px; opacity:.82; text-transform:uppercase; } .kb-hero h1 { margin:0 0 7px; font-size:30px; line-height:1.15; letter-spacing:0; } .kb-lede { margin:0; font-size:15px; opacity:.93; max-width:820px; } .kb-badges { display:flex; flex-wrap:wrap; gap:8px; margin-top:16px; } .kb-badge { padding:4px 11px; border-radius:14px; background:rgba(255,255,255,.18); font-size:12px; white-space:normal; } .kb-toc,.kb-panel { background:var(--surface); border:1px solid var(--line); border-radius:8px; } .kb-toc { padding:18px 24px; margin-bottom:24px; } .kb-toc-title { margin:0 0 8px; color:#374151; font-size:13px; font-weight:700; letter-spacing:.5px; text-transform:uppercase; } .kb-toc ol { margin:0; padding-left:22px; line-height:2; } .kb-toc a { color:var(--blue); text-decoration:none; } .kb-toc a:hover { text-decoration:underline; } .kb-section { margin-bottom:28px; scroll-margin-top:16px; } .kb-section-title { margin:0; padding:12px 20px; border-radius:8px 8px 0 0; background:var(--blue); color:#fff; font-size:17px; letter-spacing:0; } .kb-panel { padding:20px 22px; border-top:0; border-radius:0 0 8px 8px; } .kb-panel p:first-child { margin-top:0; } .kb-callout { margin:0 0 18px; padding:13px 16px; border-left:5px solid var(--blue); border-radius:0 7px 7px 0; background:#eef5fc; } .kb-callout.critical { border-color:var(--red); background:#fff1f0; color:#7a271a; } .kb-callout.warning { border-color:var(--amber); background:#fff8e7; color:#6b4d00; } .kb-callout.success { border-color:var(--green); background:#ecfdf3; color:#05603a; } .kb-table-wrap { overflow-x:auto; margin:16px 0; border:1px solid #e5e7eb; border-radius:7px; } table { width:100%; border-collapse:collapse; font-size:13px; min-width:680px; } th { padding:9px 12px; background:var(--blue-dark); color:#fff; text-align:left; } td { padding:9px 12px; border-bottom:1px solid #e5e7eb; vertical-align:top; overflow-wrap:anywhere; } tr:nth-child(even) td { background:#f8fafc; } code { padding:1px 4px; border-radius:3px; background:#f1f3f5; font-family:ui-monospace,SFMono-Regular,Menlo,monospace; font-size:.92em; overflow-wrap:anywhere; } pre { overflow:auto; padding:14px; border-radius:6px; background:#111827; color:#f9fafb; } details { margin:0 0 12px; border:1px solid #bfdbfe; border-radius:6px; overflow:hidden; background:#fff; } summary { cursor:pointer; padding:12px 16px; background:#eff6ff; color:#1e3a5f; font-weight:700; } details > div { padding:16px; background:#fff; } .confidence { display:inline-block; padding:2px 8px; border-radius:12px; font-size:12px; font-weight:700; } .confidence.confirmed { color:#05603a; background:#ecfdf3; } .confidence.probable { color:#6b4d00; background:#fff8e7; } .confidence.unverified { color:#7a271a; background:#fff1f0; } .kb-footer { padding:16px 20px; color:var(--muted); font-size:12px; background:#f8fafc; border:1px solid var(--line); border-radius:8px; } @media (max-width:640px) { body { padding:12px; } .kb-hero { padding:22px 20px; } .kb-hero h1 { font-size:24px; } .kb-panel { padding:16px; } .kb-section-title { padding:11px 16px; } table { min-width:620px; } }

ServiceNow Discovery - Knowledge Article

MSSql DB On Windows Pattern Troubleshooting Interactive checklist for requirements, credentials, properties, pattern logs, allow-list failures, and field-level troubleshooting for the Windows SQL Server database pattern.

Pattern: MSSql DB On Windows Target: cmdb_ci_db_mssql_instance Default port: 1433 Use case: public KB Contents

Overview Prerequisites and Prechecks Expected Execution Flow Pattern Step Requirements Pattern Command Reference Step-by-Step Troubleshooting Error and Symptom Reference Properties, Tables, and Roles Validation and Next Actions Known Issues and Limitations Sources Overview Pattern scope: This article covers MSSql DB On Windows , the Windows database pattern for Microsoft SQL Server. MSSql DB On Windows discovers Microsoft SQL Server instances on Windows hosts. In ACC-based execution, Enhanced Discovery collects host process data, the instance classifies the process, the corresponding sa_pattern is selected, the MID Server orchestrates the pattern, and remote commands execute through the ACC connection instead of SSH or WinRM.

Item Value Notes Pattern MSSql DB On Windows Discovery pattern used for SQL Server on Windows. Target CI table cmdb_ci_db_mssql_instance Stores discovered Microsoft SQL Server instance CIs. Typical port 1433 Default SQL Server listener port; named instances or custom configurations may use a different port. Pattern table sa_pattern Stores Discovery Pattern records. Pattern language NDL, Neebula Discovery Language Pattern definition language used by Discovery patterns. Prerequisites and Prechecks Area Required check Why it matters Plugins Discovery is active, including Pattern Designer. Pattern content is available from sn_itom_pattern or legacy Visibility Content sn_pattern_design . The pattern cannot run if Discovery or pattern content is absent. MID Server MID is up, validated, reachable, and able to process ECC queue work. The MID orchestrates pattern execution even when commands are executed through ACC. MID role The MID user/MID record has the pattern execution capability normally described as PD MID . The MID must interpret and run pattern-based probes. ACC agent ACC-F/ACC-V is version 3.1.0 or later where ACC pattern execution is expected. Older agents may not support pattern execution. Agent config enable-patterns-on-agent: true is set in acc.yml , followed by an ACC service restart. Missing this setting can prevent patterns from running at all. Instance property sn_agent.appl_classification_behavior is set to full . This enables full application classification and pattern execution. Host discovery The Windows host is discovered/classified and SQL Server processes are visible to Enhanced Discovery. Application patterns trigger from classified processes. Allow-list The ACC allow-list contains the commands needed by this pattern. The agent blocks commands that are not allowed. Credentials Host access and SQL Server applicative credentials are available where the pattern requires them. Patterns need application credentials in addition to host credentials when collecting application details. Expected Execution Flow Enhanced Discovery runs and collects running process and TCP connection data from the Windows host. The instance classifies the process as a known application. The matching application pattern, MSSql DB On Windows , is selected from sa_pattern . The MID Server receives and orchestrates the pattern execution request. The MID uses the ACC connection to execute remote commands on the agent host. The ACC agent checks check-allow-list.json or generated pattern allow-list content before executing each command. The MID processes the pattern output and creates or updates SQL Server CIs in CMDB. The result appears in Application Pattern logs as Success, Warning, or Failure. Pattern Step Requirements This table summarizes the important MSSql DB On Windows pattern phases visible in the pattern definition. Use it when reviewing Pattern Designer debug output: start at the first failed step, confirm the requirement for that step, then check the evidence column before moving forward.

Pattern phase or step group What the step is doing Requirement Evidence to check when it fails Identification for MS SQL Server Starts from cmdb_ci_endpoint_ms_sql_server or cmdb_ci_endpoint_tcp and uses the listening-port process strategy to target the SQL Server process. The host must have Enhanced Discovery/process data, a listening SQL Server endpoint, and a classified sqlservr.exe process. Agent Application Pattern log, entry point type, process PID, endpoint port, and whether the pattern selected this identification section. list namespace names in SqlServer namespace , filter namespaces , verify at least one namespace name exists Queries \\Root\\Microsoft\\SqlServer , keeps ComputerManagement namespaces, and stops gracefully if no SQL Server WMI namespace is available. Windows WMI must expose SQL Server ComputerManagement* namespaces, and the execution context must be allowed to query them. Failure message MSSQL servers must have at least one ComputerManagement WMI namespace. Exit! , WMI query output, namespace availability on the target host, and account permissions. get version from command line if process exist , if process is empty get process match our instance , verify we have sqlservr process Uses the discovered process executable path or searches for the matching process, then validates that the process is sqlservr.exe . The process data must include process.executablePath or enough command-line/process evidence to find the SQL Server process. Pattern variables process.executablePath , mssql_commamd , PID filtering, and command output from "sqlservr.exe" -v . HD: Parse instance name , TD: set instance name from MSSQL Endpoint , Break if instance_name not defined Extracts the SQL instance name from process command line -s , or falls back to the endpoint instance value. At least one source must provide the instance name: process command line, endpoint instance, or later process lookup. Pattern variable instance_name , process command line, endpoint instance, and termination message Exit due to unknown MSSQL instance name. Get WMI namespace by instance name , Get WMI namespace by port , Verify there is the version specific namespace Finds the version-specific SQL Server WMI namespace by instance name or TCP port. ServerNetworkProtocolProperty data must be readable from the SQL Server WMI namespace, and either instance name or port must match. Variable nm , WMI query errors, entry_point.port , instance_wmi , and message Failed to identify the MSSQL version specific WMI namespace. Exit! Extract the port by instance name , Set tcp_port , find tcp_port from netstat , If tcp_port is empty set to default port Derives the SQL TCP port from WMI, entry point data, netstat , or final fallback to 1433 . WMI, endpoint data, or netstat must provide the listener port; if not, the pattern assumes default port 1433 . Variables tcp_port , instance_wmi , netstat_port , command text containing netstat -a -n -o | findstr , and allow-list coverage for pipe characters. Get the version from WMI if empty , Get MSSQL version - extract the first value , Get MSSQL installed path Uses SqlServiceAdvancedProperty values such as VERSION and INSTALLPATH when command-line parsing did not populate version or install path. SQL Server WMI advanced properties must be present and readable. Variables instance_version , instance_installed_path , version , install_directory , and WMI query output. Get version name from sql query , SQL property query steps Runs sqlcmd queries such as SELECT @@version and SERVERPROPERTY to populate version, product level, engine edition, and related attributes. SQL Server must accept the selected SQL or integrated credential, TCP connectivity must work, and sqlcmd must be executable and allowed. Credential test results, connType , sqlcmd output, authentication errors, TCP port reachability, and generated allow-list entries for sqlcmd . populate MSFT SQL Instance and related transform steps Writes discovered values to cmdb_ci_db_mssql_instance , including instance, name, version, edition, service pack, engine edition, install status, and discovery source where available. Mandatory attributes must be populated before transform, and CMDB/IRE processing must accept the payload. Transformed payload, discovery_log , ecc_queue response, IRE identification result, and the resulting cmdb_ci_db_mssql_instance record. Connection sections: Storage connectivity , create db connections , SSIS/SSAS/CRM backward connections Creates storage, database, SSIS, SSAS, and related application connections when matching entry point or registry/WMI evidence exists. Required entry point data, registry keys, WMI database lists, and related process evidence must exist for the optional connection section being evaluated. Connection section status, WMI/registry query output, created endpoint records, relationship payloads, and whether the section terminated by design because the entry point type did not match. Important boundary: If a debug log fails inside a later extension section such as Set Edition if empty , inspect the affected pattern export, extension section, or debug payload that contains that step; do not assume every failing step is contained directly in the base MSSql DB On Windows pattern section. Pattern Command Reference The following command families are commonly involved when troubleshooting MSSql DB On Windows . Treat variable tokens such as $$username$$ and $$password$$ as pattern placeholders, not literal values to paste into logs or articles.

Command or operation Purpose Troubleshooting focus sqlcmd -Stcp: computer_system.primaryHostname Connect to SQL Server over TCP. Check SQL listener, DNS/hostname resolution, port reachability, and allow-list coverage. netstat -ano | findstr port Find listening or established connections and owning process IDs. Check Windows permissions and allow-list handling for pipe characters. sqlcmd -h-1 -U $$username$$ -P '$$password$$' -Stcp: computer_system.primaryHostname Run SQL query without headers using supplied SQL credential. Check SQL credential validity, quoting, password special characters, and output parsing. get_attr operations Parse pattern output into attributes. Check whether the previous command returned expected text and whether parsing produced empty variables. sqlcmd -U $$username$$ -P '$$password$$' -Stcp: computer_system.primaryHostname Run SQL command with supplied SQL credential. Check app credential, SQL Server authentication mode, and account permissions. Step-by-Step Troubleshooting No pattern execution appears for the host Confirm the ACC agent is connected and reporting inventory for the Windows host. Open the agent record and check whether Enhanced Discovery has completed recently. Verify enable-patterns-on-agent: true in acc.yml , then restart the ACC service. Verify sn_agent.appl_classification_behavior = full on the instance. Confirm the Discovery plugin com.snc.discovery is active. Confirm ACC-F and ACC-V are 3.1.0 or later for ACC pattern execution. Check whether the SQL Server process was classified. If classification did not match, the application pattern will not be selected. Open sa_pattern and confirm MSSql DB On Windows is active and available in the pattern library. Pattern status is Warning or Failure Open the Application Pattern logs tab from the agent record. Open the log for MSSql DB On Windows . Identify the first failed step. Start with the first red step rather than later missing-field symptoms. Check the command executed, command output, return code, execution time, and parsed variables. If the command was denied, troubleshoot the allow-list first. If the command ran but returned no data, validate SQL permissions, target host, SQL listener, and command syntax. If the command returned data but fields are blank, inspect the pattern parsing step or get_attr operation. Command denied by ACC allow-list Typical evidence includes command-denied text in the pattern log or a message similar to check command denied due to invalid character . This is common when generated pattern commands use characters such as pipe, redirection, or shell separators and the host is only using the generic allow-list.

Open Command Validation Tool and refresh the command list. Open pattern_allowlist.do or the Pattern Allowlist Generator. Select MSSql DB On Windows , or select all patterns if the environment manages allow-lists centrally. Enable substitution of temporary variables with regex when generating entries. Generate the allow-list entries. Merge the generated entries into the agent allow-list. Common paths include C:\ProgramData\ServiceNow\agent-client-collector\config\check-allow-list.json and C:\ProgramData\servicenow\agent-client-collector\check-allow-list.json , depending on agent packaging. Restart the AgentClientCollector service. Re-run Enhanced Discovery or Pattern Designer debug and confirm the denial is gone. SQL connection or authentication fails Confirm SQL Server is listening on the expected port. The local pattern catalog lists default port 1433 . Confirm the host name used by computer_system.primaryHostname resolves from the execution context. Confirm the SQL Server instance accepts TCP connections and the required protocol is enabled. Validate the SQL applicative credential outside the pattern using an approved test path. Do not paste passwords into case notes or KB articles. Check whether SQL Server uses Windows authentication, SQL authentication, named instances, or non-default ports; align credentials and connection parameters accordingly. If all credentials share the same order, Discovery may try them unpredictably. Set credential order when multiple credentials can match. Edition, version, or instance attributes remain blank Confirm whether the pattern completed with Success or Warning. A Warning can still create a partial CI. Check the step that retrieves version or edition and confirm the command actually executed. If the command is empty or becomes "" -v , investigate temporary-variable substitution in the pattern or extension section. If the command is denied, fix the allow-list before analyzing output parsing. If the command runs but output is empty, test the SQL/WMI/registry command under the same account context used by the pattern. Check whether the affected logic is in an extension section or shared library that runs after the identification section. Confirm the store pattern content is current. ServiceNow releases pattern content through store applications; if an update or workaround changes only part of a related MSSQL pattern/extension flow, a later extension step can still require separate review. Error and Symptom Reference Symptom Likely layer First action No Application Pattern log exists Classification or prerequisites Check Enhanced Discovery, enable-patterns-on-agent , and sn_agent.appl_classification_behavior . Pattern is Failure Critical pattern step failed Open the first failed step in Pattern Designer debug. Pattern is Warning Partial data collection Check which field group failed and whether a partial CI was created. Command denied by allow-list ACC agent policy Generate and deploy pattern-specific allow-list entries. sqlcmd not found Host binary/path Confirm SQL client tooling path and allow-list entry. Authentication failure Credential Validate host and SQL applicative credentials; set credential order. Blank edition/version Command, parsing, or pattern extension Verify command execution, output, and extension/shared-library steps. No CMDB update after command success Payload, sensor, or IRE Check discovery_log , ecc_queue , and identification results. Properties, Tables, and Roles Name Type Use sn_agent.appl_classification_behavior Property Set to full for full ACC application classification and pattern execution. enable-patterns-on-agent ACC config Set to true in acc.yml . glide.discovery.save_pattern_log Property Controls pattern log saving behavior; failure logs are saved even when optimized. sa_pattern Table Discovery Pattern records, including MSSql DB On Windows . ecc_queue Table Probe/pattern work and responses between instance and MID. discovery_status Table Discovery run status. discovery_log Table Per-device errors and discovery messages. pd_command_list Table Command Validation and allow-list tooling reference. PD user Role Read-only Discovery Pattern Log access. PD admin Role Create/edit/publish patterns. pde_viewer Role Read-only Command Validation tooling access. PD MID MID capability/role context Enables MID pattern interpretation and execution. Validation and Next Actions Re-run Enhanced Discovery or Pattern Designer debug for the target Windows SQL Server host. Confirm the Application Pattern log for MSSql DB On Windows shows Success, or document the first Warning/Failure step. Open the generated or updated CI in CMDB and validate cmdb_ci_db_mssql_instance fields such as name, version, edition, and relationships. If the pattern succeeds but CI update fails, move investigation to IRE and CMDB identification rather than ACC command execution. If a specific command still fails, capture the pattern step name, command text with secrets redacted, return code, stderr/stdout, and allow-list entry used. Known Issues and Limitations ACC pattern execution does not behave exactly like SSH/WinRM execution. Shell syntax, service-account context, and allow-list enforcement can change outcomes. Put File operations and some probe-based flows are not supported through the ACC pattern channel. Pattern debug mode does not use credential affinity, so debug results can differ from scheduled discovery credential selection. Customer-specific extension sections such as Set Edition if empty must be checked in the affected pattern export or debug log when that is where the failure appears.