--- schema_version: "1" id: 001ee7651a8610525d8acb084f23f2dff5cc22422d6d4497b4a0b6fd0c673ad9 title: Troubleshoot Agentless Discovery Scans collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/it_srvcs_discovery_troubleshoot_agentless_scans.md canonical_url: https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_troubleshoot_agentless_scans.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 1fadd758287f12bcdf33c854c75e1a9e218be3e0e217bfcaf75f06f038fbc252 description: Resolve target connectivity, authentication, and access issues to restore agentless discovery coverage and keep CMDB data current. Review scan job details and Discovery Application logs to identify where a scan stopped and apply the appropriate resolution. products: - Service Cloud - Agentforce IT Service release: "264" --- # Troubleshoot Agentless Discovery Scans Resolve target connectivity, authentication, and access issues to restore agentless discovery coverage and keep CMDB data current. Review scan job details and Discovery Application logs to identify where a scan stopped and apply the appropriate resolution. ### Required Editions
Available in: Lightning Experience
Available in: Enterprise, Performance, and Unlimited Editions with Agentforce IT Service that have Discovery enabled.
## Resolve Agentless Discovery Scan Issues Use the scan symptom to identify the likely cause. For a failed or incomplete scan, check target reachability, network access, credentials, scan job details, and Discovery Application logs. Verify the target again before you rerun the scan. 1. From the Discovery Application host, verify that the target responds to an ICMP echo request. 2. Confirm that the network allows the protocol and port required by the selected probe. 3. Confirm that the discovery target uses the correct active credential and that the account or identity has the required target access. 4. Open the scan job in Salesforce and search the scan details for the target IP address or host name. 5. If the scan job details don’t identify the cause, review the Discovery Application logs on the host. | Issue | Resolution | | --- | --- | | A target isn't discovered or appears unreachable. | From the Discovery Application host, verify that the target is powered on and responds to an ICMP echo request. Confirm that the target address is included in the scan scope and isn't excluded from the discovery target. | | The connection to a target times out. | Verify that the Discovery Application host can reach the target by using the protocol and port required by the selected probe. Review firewall and network access rules on the host, target, and intervening network devices. | | The scan can't authenticate to a target. | Verify that the discovery target uses the correct active credential. Remove leading or trailing spaces from credential values, and confirm that the account or identity is active and has the required target access. | | A Windows scan can't open a remote session. | Confirm that the target is prepared for the selected Windows Management Instrumentation or PowerShell Remoting probe. Verify the required Windows services, account access, and firewall rules on the target and Discovery Application host. | | A Linux, Unix, or macOS scan returns incomplete data. | Verify Secure Shell access for the scanning account. For Linux and Unix, verify the sudo access required for hardware details. For macOS, verify Remote Login access and permission to run system\_profiler. | | A Simple Network Management Protocol (SNMP) scan returns incomplete device data. | Verify that the device supports the selected SNMP version and accepts the configured credentials. Grant the SNMP identity read-only access to the full Management Information Base tree. | | A VMware vCenter scan can't collect inventory data. | Verify HTTPS connectivity from the Discovery Application host to VMware vCenter Server. Confirm that the VMware vSphere credentials have read-only access to the vCenter inventory. | | An AWS or Azure scan doesn't return the expected resources. | Verify that the cloud credentials authenticate with the provider API. Confirm that the identity has read-only access to the accounts, subscriptions, and resource types included in the discovery target. | Review the required connection for each probe before you change firewall or credential settings. For more information about agentless discovery connectivity, see [Agentless Discovery Network, Port, and Access Requirements](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_network_access_requirements.htm&release=264.0.0&type=5 "Improve agentless scan reliability and keep discovered asset data current. Review the connectivity and access requirements for each supported probe before you create discovery targets."). Apply the preparation requirements for the affected target type: - For more information about preparing Windows targets, see [Prepare Windows Targets for Agentless Discovery](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_prepare_windows_targets.htm&release=264.0.0&type=5 "Improve Windows scan reliability and keep asset data in CMDB current by preparing target systems for agentless discovery. Configure account access, remote management, and firewall rules for the Windows Management Instrumentation (WMI) or PowerShell Remoting probe that you plan to use."). - For more information about preparing Linux, Unix, and macOS targets, see [Prepare Linux and macOS Targets for SSH Discovery](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_prepare_ssh_targets.htm&release=264.0.0&type=5 "Collect complete Linux, Unix, and macOS inventory data and keep CMDB records current by preparing target systems for Secure Shell (SSH) discovery. Provide a dedicated scanning account, the access required for system and hardware details, and network connectivity from the Discovery Application host before you create the discovery target."). - For more information about preparing network devices, see [Prepare Network Devices for SNMP Discovery](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_prepare_snmp_targets.htm&release=264.0.0&type=5 "Discover switches, routers, firewalls, printers, and other network devices accurately by preparing them for Simple Network Management Protocol (SNMP) scans. Turn on a supported SNMP version, provide read-only access to the required management information, and allow connectivity from the Discovery Application host before you create the discovery target."). - For more information about preparing cloud and virtualization targets, see [Prepare Cloud and Virtualization Targets for Discovery](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_prepare_cloud_virtualization_targets.htm&release=264.0.0&type=5 "Build a current inventory of cloud and virtual infrastructure by preparing provider accounts and VMware vCenter for discovery. Grant read-only access to the resources in scope, verify the required HTTPS connectivity, and capture the authentication details that you use to create discovery credentials and targets."). ## Review Scan Job Details Open the scan job in Salesforce and review the **Host Summary** and **Scan Details** sections. Compare the target, probe type, credentials, start and end times, and scan status with the discovery target configuration. Review **Discovered Assets** to identify assets that are missing or that didn't update. Refresh the scan job after data processing completes to review the latest results. For more information about scan job sections and results, see [Monitor and Review Scan Jobs](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_monitor_scanjob.htm&release=264.0.0&type=5 "Monitor discovery progress and review scan results with scan jobs. Each scan job tracks the execution of a discovery target and provides detailed visibility into discovered assets, scan duration, and completion status. Use the scan job details to verify discovery coverage and ensure that your CMDB data remains accurate and up to date."). ## Review Discovery Application Logs If the scan job details don't identify the cause, review the logs on the Discovery Application host. The default log folder is C:\\Program Files\\Salesforce\\Discovery Application\\logs. Search the log for the target IP address or host name and the time when the scan ran. discovery.txt Records Discovery Application activity, including scans, probe requests, and communication with target systems. Archived files use names such as discovery\_YYYY-MM-DD.0. windows\_service.txt Records the Discovery Application service lifecycle, environment setup, and Java startup activity. Review this log when the Discovery Application service doesn't start or remain available. ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-it_service-264-0-0-production-enus/0a574a10-4c7a-4681-aacf-0767f8beaad4/images/icon_important.png) Important Before you share log files, review them and redact credentials, tokens, and other sensitive information according to your company's security policies.