Chapter 10. Run and manage deep scans

Run a deep scan to detect products installed in nonstandard locations. Deep scans use the find command and can be CPU-intensive, so use discretion on production systems. After you run a scan for the first time, the scan is saved to the Scans view. From that view, you can run the scan again to update its data.

After you name a scan and run it for the first time, it is added to the Scans view. You can then run a new instance of that scan, known as a scan job, to update the data that is gathered for that scan.

Cancel a running scan job to free system resources or address higher-priority operational needs.

Deleting a scan is a nonreversible action that deletes the scan and all scan jobs for that scan. Deleted scans cannot be retrieved.

After you create sources and credentials, you can create scans. A scan groups sources into a reproducible inspection unit. Each time a saved scan runs, that instance is stored as a scan job. The output of a scan job is a report containing the facts gathered for all IT resources in the scanned sources.

A scan includes at least one source and the credentials that were associated with that source at source creation time. When the scan job runs, it uses the provided credentials to contact the assets contained in the source. It then inspects the assets to gather facts about those assets for the report. You can add multiple sources to a single scan, including a combination of different types of sources into a single scan.

A scan job manages one or more inspection tasks that gather data from systems defined in the scan’s sources. These tasks handle all aspects of connecting to systems and collecting information needed to generate the scan’s reports.

When a scan job runs, Discovery creates an inspection task for each source assigned to the scan. Each inspection task connects to systems defined by its source and collects facts that Discovery uses to produce the scan’s reports.

If a source includes multiple systems, the inspection task attempts to connect to and inspect each one. If some systems are unreachable, the task records partial results based on the systems it was able to inspect.

In scans with multiple sources, each source’s inspection task runs independently of the inspection tasks for other sources. A scan job is marked as completed only if all inspection tasks across all sources finish successfully. If any inspection task fails or cannot connect to any systems in its source, the scan job is marked as failed.

A scan job, or individual instance of a scan, moves through several states during its life cycle.

When you start a scan, a scan job is created and the scan job is in the created state. The scan job is then queued for processing and the scan job transitions to the pending state. Scan jobs run serially, in the order that they are started.

As the Discovery server reaches a specific scan job in the queue, that scan job transitions from the pending state to the running state as the processing of that scan job begins. If the scan process completes successfully, the scan job transitions to the completed state and the scan job produces results that can be viewed in a report. If the scan process results in an error that prevents successful completion of the scan, the scan job halts and the scan job transitions to the failed state. An additional status message for the failed scan contains information to help determine the cause of the failure.

Other states for a scan job result from user action that is taken on the scan job. You can pause or cancel a scan job while it is pending or running. A scan job in the paused state can be resumed. A scan job in the canceled state cannot be resumed.