Scan Job Remediation

Resolving issues with discovery results is an iterative process:

• Configure and run Scan Jobs

• Review results of Scan Jobs in IT Explorer and Scan Results & Scan Status

• Refine Scan Jobs until the environment has been completely discovered

• Review the findings

  • Extend/Modify the Scan job scopes

  • Blacklisting low-interest processes

  • Adding Fingerprints and Templates to model the environment more accurately

This document provides examples for the review results section and identifies how improvements to the successful coverage of the scan operation can be achieved.

IT Explorer

The IT Explorer interface identifies the server and services that have been discovered during the scanning process.

 

Scan Job Results

The Scan Jobs tab displays the outcome of the Scan, including Servers scanned and updates in a simple summary page.

 

 

The general operational numbers for each scan job can be seen in the progress bar. Hovering over each progress bar will identify a more concise breakdown of numbers associated with the scan.

 

The individual elements of the scan job can be further examined by double-clicking an individual scan job. This shows the history of the scan job execution with the progress bar for each execution.

Each scan execution can be further examined by clicking a single scan. A dialogue that identifies two tabs:

• The Scan Results tab shows all changes related to Servers, Containers, and CI's derived by application dependency mapping, i.e. Services, Software Clusters, and Found Groups.

• The Scan Status tab displays the information about the scan per IP Address. Columns can be sorted to quickly identify things like IP addresses taking a lot of time to be scanned, or IPs where credentials didn't provide access to target systems.

Scan Failures Details and Actions

Scan Status	Description	Category	Action Required by	Action
Success	Successfully scanned	Scanned	None	None
NoConnection	System is reachable by ping, but has none of the required port(s) open allowing a connection to be established.	Not Scanned	Customer	Check firewall ports.
CredentialFailed	Authentication failure	Not Scanned	Customer	Check Credentials.
InsufficientPriviliege	Credentials do not allow to execute the commands required to generate a guaranteed unique and durable unique identifier.	Not Scanned	Customer	Check Credentials.
ScanFailure	Unrecoverable or unexpected errors, untrustable ids, missing key CI’s, or timeouts / aborted target scan.	Not Scanned	ServiceProvider	Check Logs.
SkippedAsSameAs	Target has already been scanned in the same Scan Job, via a different IP, i.e. scan result has already been sent to the SAAS platform.	Skipped	None	None
ConnectionFailed	An unexpected error happened during connection, i.e. error is different than InsufficientPrivileges or CredentialFailed (incorrect credentials).	Not Scanned	ServiceProvider	Check Logs.
UnusableConnection	Target has been successfully connected, but some 'services' (like RPC) are missing on target, preventing a successful scan	Not Scanned	Customer	Check firewalls and/or target system health.
NoAnswer	Target unreachable.	Not Scanned	Customer	Check Scope, Firewalls, is device turned on?
NoCredential	Target identified and type identified (i.e. Unix, Windows, etc.), but no corresponding Credential in Scan Job config.	Not Scanned	Customer	Check Credentials.
Unknown	Unexpected condition.	Not Scanned	ServiceProvider	Check Logs.
PartialScan	Target has been successfully connected with appropriate privilege levels and a trustable target identifier has been generated, however, some data has not been collected, like Disks, Filesystems, processes, Connections, etc.	Not Scanned	ServiceProvider	Check Logs.
SkippedAsWorkStation		Skipped	None	None
SkippedAsExcluded	Target is in the list of excluded IPs.	Skipped	None	None
Aborted		Not Scanned	ServiceProvider	Check Logs.
NoResult	No scan result was received by CAM	Not Scanned	ServiceProvider	Check Logs.
CredentialNoLongerWork	Credential no longer works.	Not Scanned	Customer	Check Credentials.
LockedAccount	The connection was not established due to too many authentication failures	Not Scanned	Customer	Check if credential provided is correct and assigned to correct scan job. If correct, unlock account on target.
ConnectionTimedOut	The login timed out.	Not Scanned	Customer	Check if connection available manually (and not blocked by anti-virus software/firewall).
DNSResolutionFailed	Unable to resolve the target HostName provided in the Scan Job scope into an IP Address.	Not Scanned	Customer	Manually check if DNS resolution works on appliance.

Scan Info Details and Actions:

Scan Status	Description	Category	Action Required by	Action
Failed to gather Process Connections	A O/S command was unable to generate a list of connections from local processes to remote machines. The list of process connections is used to provide application dependency mapping within the product	Process Collection	Customer	Check Credentials for permission to execute the netstat command on *nix machines.
There is one truncated process with the following process ID: [NNNN].	The command line of a process is used to identify the executable that is being run. O/S limitations can restrict the total size of the command line that can be returned. This error identifies that the process command line could not be generated due to O/S restrictions.	Process Collection	None	There is no action that can be undertaken by teh customer in this case.
'dmidecode' command is not available.	Dmidecode is a (*nix) tool for dumping a computer's DMI (or SMBIOS ) table contents in a human-readable format. This table contains a description of the system's hardware components, as well as other useful pieces of information such as serial numbers and BIOS revision. This command is one of the commands that an be used to uniquely identify a server from its peers. If this command is not available or can’t be run then it is possible that uniqueness cannot be established and the target cannot be fully scanned.	Uniqueness	Customer	Check Credentials for permission to execute the dmidecode command. On some *nix operating systems dmidecode is an installable option. If this is the case then install the dmidecode command package.
Failed to gather Identifier.Please visit <link> for more information.	A command(s) is used to uniquely identify a server from its peers. If this command(s) is not available or can’t be run then uniqueness cannot be established and the target cannot be fully scanned.	Uniqueness	Customer	Visit specified link for additional information it is possible to force a unique identifier to be generate (without using O/S native tools) by enabling the scan job option EnableGeneratedID.
Command 'SELECT SERIALNUMBER FROM Win32_BIOS' failed to get serial number.	A WMI Windows command is used to uniquely identify a server from its peers. If this command is not available or can’t be run then uniqueness cannot be established and the target cannot be fully scanned.	Uniqueness	Customer	Check Credentials for permission to execute the dmidecode command over WMI. Note: it is possible to force a unique identifier to be generate (without using O/S native tools) by enabling the scan job option EnableGeneratedID.
Workstation Skipped	Target has already been skipped as the O/S has been identified as an Workstation edition.	Not Scanned	None	Check Logs
No HTTP communication from target machine to the appliance VM (http://<appliance IP>:8080)	The connection from the scanned server back to the appliance port 8080 is blocked. This means that metrics collected from teh scanned server cannot be returned to appliance and then to the SAAS platform. Metrics will not available for this machine in the CAM UI.	Metrics	Customer	Login into the scanned server and check that port 8080 on the appliance IP is reachable. Windows: Press the Windows key + R, then type "cmd.exe" and click OK. Unix: On *nix open a shell THEN Enter telnet <appliance-IP> 8080 to run the telnet command and test the TCP port status. If the port is open, only a cursor will show. Otherwise, an error will be displayed.