{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":28706,"path":"it-operations-management/agent-client-collector/acc-visibility-checks-policies.md","title":"Agent Client Collector for Visibility Content default checks and policies","bundle":null,"doc_type":null,"release":"australia","body":"\n# Agent Client Collector for Visibility Content default checks and policies\n\nAgent Client Collector for Visibility Content \\(ACC-VC\\) provides various checks and policies as well as a business rule.\n\n## Policies\n\n**Note:** ACC-VC policies execute at a frequency of once per day. The total data ingested would be approximately 572KB. This takes into consideration an average of approximately 1500 installed software applications and approximately 500 running processes other than CI data per machine.\n\n<table id=\"table_g55_dyy_5dc\"><thead><tr><th>\n\nName\n\n</th><th>\n\nDescription\n\n</th><th>\n\nCheck definitions\n\n</th></tr></thead><tbody><tr><td>\n\nEnhanced Discovery\n\n</td><td>\n\nRuns on a schedule, by default every 24 hours \\(86400 seconds\\). The policy interval can be adjusted, for example to run every 4 hours \\(set the interval to 14400\\). The ACC-VC policy configuration is synced to all agents based on the policy filter defined by ACC-VC. Update the following ACC-F system properties, if needed:-   **sn\\_agent.disco\\_minimum\\_threshold\\_for\\_rediscovery\\_minutes**: to avoid discovering the system too frequently.\n-   **sn\\_agent.disco\\_disable\\_ci\\_clobber\\_of\\_agentless\\_disco**: to avoid Discovery conflicts.\n-   **sn\\_agent.disco\\_ci\\_clobber\\_of\\_agentless\\_disco\\_threshold\\_days**: to avoid Discovery conflicts.\n\nOn Windows non-persistent VDI endpoints \\(NPVDI\\), ACC-VC can skip some inventory modules. For more information, see [ACC-VC NPVDI system properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/agent-client-collector/accvc-npvdi-properties.md).\n\n</td><td>\n\nEnhanced Discovery\n\n</td></tr><tr><td>\n\nSAM Discovery\n\n</td><td>\n\nResponsible for capturing the software installed on any endpoint device, such as Windows desktops or macOS servers.\n\n</td><td>\n\nSoftware installations and usage metrics\n\n</td></tr><tr><td>\n\nSAM background\n\n</td><td>\n\nEnables a background job for processing the Osqueryd logs for SAM on Windows and macOS endpoint devices.\n\n</td><td>\n\nSAM background log check\n\n</td></tr><tr><td>\n\nSAM background \\(Non OsqueryD\\)\n\n</td><td>\n\nEnables a background job to collect SAM information using osqueryi instead of osqueryd.\n\n</td><td>\n\nSAM Background Policy \\(Non OsqueryD\\)\n\n</td></tr><tr><td>\n\nSoftware installed\n\n</td><td>\n\nResponsible for capturing the software installed on all devices except for Windows endpoint devices. The data collected is stored in the \\[cmdb\\_sam\\_sw\\_install\\] table. Scheduled to run every 24 hours.\n\n</td><td>\n\ninstalled software\n\n</td></tr><tr><td>\n\nFile-based Discovery background policy\n\n</td><td>\n\nTakes the config file as input from the instance to an agent. Scans the system using config file parameters and stores the output in two separate files on the agent.-   FBDSAMOutput.json: Stores metadata related to the set of file names generated from the **samp\\_file\\_name** table.\n-   FBDFileOutput.json: Stores metadata related to files scanned by a wildcard extension.\n\nRuns on the agent when file-based discovery is invoked. For details, see [Agent Client Collector File-Based Discovery](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/agent-client-collector/file-based-discovery-overview.md).\n\nDefault: false. To activate, navigate to **All** &gt; **Discovery Definition** &gt; **Configuration Console** and in the **File Based Discovery** section, activate the Enable File Based Discovery toggle switch.\n\n</td><td>\n\nFile-based discovery background\n\n</td></tr><tr><td>\n\nFile-based Discovery - SAM\n\n</td><td>\n\nDiscovers known software files on the endpoint. Uses an allowlist of recognized software filenames maintained by ServiceNow. When a file on disk matches an allowlist entry, FBD uses the FileBasedDiscovery API to identify the collected software metadata \\(file name, path, size, and version\\), identifies the software package it belongs to and records the installation on the instance. Unrecognized files are tracked in the unidentified file records table \\(cmdb\\_unidentified\\_file\\_set\\). Runs daily.Default: false. To activate, navigate to **All** &gt; **Discovery Definition** &gt; **Configuration Console** and in the **File Based Discovery** section, activate the Enable File Based Discovery toggle switch.\n\n</td><td>\n\nFile-based discovery - SAM\n\n</td></tr><tr><td>\n\nFile-based Discovery - SWID tag\n\n</td><td>\n\nEnables SWID tag scanning on a Windows, Linux or macOS platform. When enabled, the scanner looks for `.swid`, `.swidtag`, and `.cmptag` files in the configured scan directories. Stores results in the following tables:-   cmdb\\_swid\\_tag: Parsed SWID tag records\n-   cmdb\\_file\\_information: Individual file records\n-   cmdb\\_sam\\_sw\\_install: Individual software records\n\nDefault: false. To activate, navigate to **All** &gt; **Discovery Definition** &gt; **Configuration Console** and in the **File Based Discovery** section, activate the Enable File Based Discovery toggle switch.\n\n</td><td>\n\n \n\n</td></tr><tr><td>\n\nFile-based Discovery - File management\n\n</td><td>\n\nDiscovers files based on customer-defined rules. Administrators configure which file extensions to look for and define filename matching rules such as exact match, starts with, ends with, or contains. This policy builds a device-level file inventory based on the organization's specific needs. Results are stored in the sn\\_acc\\_vis\\_content\\_device\\_file\\_information table.Configure rules in the File Matching rules \\(sn\\_acc\\_vis\\_contet\\_file\\_config\\) and File extensions \\(sn\\_acc\\_vis\\_content\\_file\\_extension\\) properties. For details on these properties, see [Agent Client Collector File-Based Discovery properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/agent-client-collector/file-based-discovery-configuration-properties.md).\n\nFile Management supports delta scanning; after the initial full scan, only added, modified, and deleted files are sent on subsequent runs. For details on delta scanning, see [Agent Client Collector File-Based Discovery](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/agent-client-collector/file-based-discovery-overview.md).\n\nDefault: false. To activate, navigate to **All** &gt; **Discovery Definition** &gt; **Configuration Console** and in the **File Based Discovery** section, activate the Enable File Based Discovery toggle switch.\n\n</td><td>\n\nFile-based discovery - File management\n\n</td></tr><tr><td>\n\nOracle GLAS Java Process Discovery\n\n</td><td>\n\nDiscovers running Java processes on endpoints and collects installation data for the Oracle GLAS license compliance report. Runs weekly.\n\n</td><td>\n\nOracle GLAS Java Process Discovery\n\n</td></tr><tr><td>\n\nOracle GLAS HW data collection\n\n</td><td>\n\nExecutes Oracle's hardware validation script on non-Oracle, non-macOS hosts to collect CPU/socket data for GLAS reporting. Runs weekly.\n\n</td><td>\n\nOracle GLAS HW data collection\n\n</td></tr><tr><td>\n\nVISC Get application metric\n\n</td><td>\n\nRetrieves the SaaS application metrics from the agents.For details on enabling SaaS usage monitoring with ACC-VC, see the [SaaS Usage Monitoring with Agent Client Collector \\[KB2320193\\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2320193) article in the Now Support Knowledge Base.\n\n</td><td>\n\nVISC Get application metric\n\n</td></tr><tr><td>\n\nVISC Get browser extension device init\n\n</td><td>\n\nInitializes the DEX browser extension with the host sysID.\n\n</td><td>\n\nVISC Get browser extension device init\n\n</td></tr><tr><td>\n\nVISC Get browser extension init\n\n</td><td>\n\nInitializes the DEX browser extension with logged-in users.\n\n</td><td>\n\nVISC Get browser extension init\n\n</td></tr><tr><td>\n\nVISC Get URL metrics\n\n</td><td>\n\nControls the collection of web usage data from Windows and macOS managed devices. Runs daily.Default: Inactive. To activate the policy, set the **sn\\_acc\\_vis\\_content.enable\\_full\\_monitoring** property to **true**.\n\nFor details on web usage data system properties, see [Web usage data collection tables and fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/agent-client-collector/web-usage-collection-tables.md).\n\n</td><td>\n\n-   VISC Get URL metrics\n-   VISC Get targeted URL metric\n\n</td></tr></tbody>\n</table>**Note:** Windows endpoint devices include devices that have a Windows operating system and belong to CI class: computer.\n\nSee [System properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-administration/r_AvailableSystemProperties.md) for more details. For more details on policies, see [Checks and policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/agent-client-collector/checks-policies.md).\n\n## Check type\n\nACC-VC has the following check types: **Enhanced Discovery**, **SAM Advanced Discovery**, and **Installed Software**.\n\n-   **__Enhanced Discovery__**\n\n    This check type is responsible for invoking the EnhancedDiscoveryHandler script include that processes the payload produced by endpoint\\_discovery.rb as executed by ACC.\n\n    Used by File-base Discovery.\n\n-   **__SAM Advanced Discovery__**\n\n    This check type is for the SAM Discovery policy that invokes the EnhancedDiscoveryHandler script include for processing the SAM data produced by the sam\\_advanced.rb file.\n\n-   **__Installed Software__**\n\n    This check type for the **Software installed policy** that invokes the EnhancedDiscoveryHandler script include for processing the installed software data produced by the installed\\_software.rb file.\n\n\n## Check definitions\n\n<table id=\"table_pkc_vdz_5dc\"><thead><tr><th>\n\nName\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nEnhanced Discovery\n\n</td><td>\n\nSynced to all agents based on the policy filter defined by ACC-VC. The Check definition is configured to run with certain assets and determines what gets synced between the agent and the MID Server. For more details on policies, see [Checks and policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/agent-client-collector/checks-policies.md).**Note:**\n\nFor the agent to retrieve the OS serial numbers and TCP connections along with associated running processes, sudo access for **dmidecode** and **ss** commands is required on Linux systems. For example, this content could be added to /etc/sudoers or to an individual file in `/etc/sudoers.d/`:\n\n```\nCmnd_Alias AGENT_ACC_V = /usr/sbin/dmidecode -s baseboard-serial-number,/usr/sbin/dmidecode -s chassis-serial-number,/usr/sbin/dmidecode -s system-serial-number,/usr/sbin/dmidecode -s system-uuid,/usr/sbin/ss -tanp\nservicenow ALL=(root) NOPASSWD:AGENT_ACC_V\n```\n\nFor the sudoers configuration example, the **must\\_sudo** check parameter, and the equivalent macOS and Windows privilege requirements, see the \"Privileges for running check commands\" section in [Checks and policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/agent-client-collector/checks-policies.md).\n\n</td></tr><tr><td>\n\nSAM background log check\n\n</td><td>\n\nRuns every 8 minutes and performs inline aggregation of data generated from Osqueryd logs. After collecting the data, it writes all the intermediate data results into a temporary marker file which is reused in the next run. This reuse limits the number of log files and disk space needed on target systems. **Note:** You may notice a spike in system resource consumption, as the background aggregation check runs every interval.\n\n</td></tr><tr><td>\n\nSoftware installations and usage metrics\n\n</td><td>\n\nCollects data every 24 hours.\n\n</td></tr><tr><td>\n\nInstalled software\n\n</td><td>\n\nFetches installed software data for all devices other than Windows and macOS endpoint devices.\n\n</td></tr><tr><td>\n\nFile-based discovery background\n\n</td><td>\n\nRuns a file scanning background job on the agent.\n\n</td></tr><tr><td>\n\nFile-based discovery\n\n</td><td>\n\nFetches the file data from the agent.\n\n</td></tr><tr><td>\n\nOracle GLAS Java Process Discovery\n\n</td><td>\n\nRuns `pbd_java_discovery.rb` via osquery to collect Java version, vendor, AMC, and licensing flags. Timeout: 600s. Runs on all platforms.\n\n</td></tr><tr><td>\n\nOracle GLAS HW data collection\n\n</td><td>\n\nRuns ```\nendpoint_discovery.rb\n        --select=oracle_glas_hw_discovery\n```\n\n to execute Oracle's `ct_cpuq` script. Executes Oracle's hardware validation script on non-Oracle, non-macOS hosts to collect CPU/socket data for GLAS reporting. Runs weekly.\n\n</td></tr><tr><td>\n\nVISC Get targeted URL metric\n\n</td><td>\n\nGathers per-day usage metrics for the monitored URL from each managed device, and sends the data back to the instance.\n\n</td></tr></tbody>\n</table>## Business rule\n\nThe **Enhanced Discovery – On CI Delete** business rule triggers the Endpoint Discovery Check when the CI associated with a given CI is deleted from sn\\_agent\\_cmdb\\_ci\\_agent.\n\n**Parent Topic:**[Agent Client Collector for Visibility Content reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/agent-client-collector/agent-client-collector-for-visibility-references.md)\n\n"}}