Discovery probes and sensors

  • Release version: Australia
  • Updated March 12, 2026
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Discovery probes and sensors

    Discovery probes and sensors are core components used to collect data and update the Configuration Management Database (CMDB) in ServiceNow Discovery. While patterns are increasingly replacing probes and sensors in recent releases, probes and sensors remain relevant for customers who have not yet adopted patterns or maintain customized probes. Probes gather data from network devices, and sensors process this data to update the CMDB accordingly.

    Show full answer Show less

    Discovery operates in four phases: scanning, classification, identification, and exploration. Probes and sensors are always used during scanning and classification. For identification and exploration, either probes and sensors or patterns may be used.

    Key Features

    • Probe and Sensor Operation: The MID Server executes probes based on instructions from the ECC queue. Probes collect data from devices and send it back to sensors for processing. Sensors then update the CMDB with this information.
    • Communication via ECC Queue: Probes and sensors communicate through the ECC queue, which manages input and output messages. The MID Server monitors this queue to trigger probe execution and sensor processing.
    • Code Signing Enforcement: When enabled, code signing ensures that probes, probe parameters, and sensors are validated and secure before execution, blocking unsigned or tampered payloads.
    • Multi-probes and Multi-sensors: Multi-probes contain multiple probes executed with a single authentication, and multi-sensors process the combined data from these probes through individual and main scripts.
    • Probe Types Supported: Includes Windows (WMI queries, shell commands), UNIX/Linux (SSH shell commands), storage devices (CIM/WBEM), printers (SNMP), network gear (SNMP), web servers (HTTP headers), and UPS devices (SNMP).
    • Customization and Version Alignment: While most customers rarely modify probes or sensors, customization is possible. After upgrading instances, customized probes and sensors should be realigned to the latest versions to ensure compatibility.

    Practical Implications for ServiceNow Customers

    • Customers not yet using patterns can rely on probes and sensors to discover and classify configuration items (CIs) in their environment.
    • Custom probes can be created or edited to tailor discovery—for example, to read specific files on Windows devices and populate CIs with that data.
    • Understanding the ECC queue and MID Server’s role helps troubleshoot discovery workflows and performance.
    • Enabling code signing enhances security for discovery operations by validating probe and sensor code integrity.
    • For customers upgrading or customizing discovery components, aligning probe and sensor versions is critical to maintaining discovery stability and accuracy.

    Discovery probes and sensors perform data collection and update the Configuration Management Database (CMDB).

    With each release, patterns are replacing many probes and sensors for Discovery. Consider creating new patterns or editing existing ones if you want to customize what Discovery can find. The information on probes and sensors is intended for customers who are not using patterns yet and for customers who already have customized probes that are retained upon upgrade. See Patterns and horizontal discovery for more information on patterns.

    Note:
    For information on Probe to Pattern migration see the knowledge article KB0694477.

    Discovery phases

    Discovery always uses probes and sensors during the first two phases of discovery: scanning and classification. For the last two phases, identification and exploration, Discovery can use probes and sensors or patterns. This topic refers to probes and sensors only. See Exploring Discovery for an explanation of these phases. See Patterns and horizontal discovery for more information on patterns.

    Probes, sensors, and the ECC queue

    The probe collects the information and the sensor processes it. Both get their instructions from the ECC queue. There is a worker job on the MID Server that monitors the queue for work. The monitor checks for any entries where the Queue is output and the State is ready.
    The ECC queue
    The MID Server then processes all the output ECC messages, runs the necessary probes, and returns the probes results to the ECC queue. These results are put in the ECC queue as input entries.
    Figure 1. ECC queue input
    ECC queue record

    After an entry is inserted in the ECC Queue table, a business rule fires (on insert) that takes that information and runs it through a sensor processor. The sensor processor's job is to take the input data, find any sensors interested in that data, and pass it along to be processed. Those sensors ultimately update the CMDB.

    Important:
    Discovery now enforces code signing for probes, probe parameters, and sensors when code signing is enabled on the instance. Unsigned or tampered payloads are blocked, and signatures are validated before execution. For more information about code signing, see Discovery on Code Signing instances.

    How probes and sensors work together

    The MID Server launches probes to collect information about a device. The probe sends back information to the sensor to be processed. If the probe has a post-processing script defined, the post-processing script does some data processing on the MID Server before data is sent back to the sensor on the ServiceNow instance. Otherwise the probes sends back all the data collected and the sensor performs this data processing. In both cases, the sensor updates the CMDB.

    A multi-probe is a probe that contains probes. A multi-sensor processes the data from a multi-probe. To process the data from the multi-probe, the multi-sensor contains individual scripts to process the data returned by each probe contained in the Multiprobe, as well as a main multi-sensor script. The individual scripts pass their processed data to the main multi-sensor script.

    The MultiSensor form

    Probe types

    Device Probe Type

    Windows

    computers and servers    		 Remote WMI queries, shell commands

    UNIX and Linux servers

    Shell command (via SSH protocol, version 2). Discovery supports any Bourne-compatible shell.
    Storage CIM/WBEM queries
    Printers SNMP queries
    Network gear (switches, routers, etc.) SNMP queries
    Web servers HTTP header examination
    Uninterruptible Power Supplies (UPS) SNMP queries