Mid Server

Configure the MID Server to connect to a source over SSL.

After installing and validating your MID Servers, ensure that they have access to sufficient system resources, probe the proper targets, and communicate with the instance as expected. Configure MID Server selection criteria, create clusters for failover protection, and set up MID Servers in different domains to protect data.

Before you install the MID Server, perform the necessary prerequisites that it needs to connect to elements inside and outside your network. This includes network privileges and security considerations.

Use the MID Server user role to configure MID Servers to access separate domains. The credentials in the config.xml file of a MID Server determine which domains it can access. Specific MID Server policy records can be restricted for use only by MID Server from the same domain.

You can configure MID Server selection by application, IP address ranges, network capability, or behavior. Specific MID Servers can be assigned to particular tasks, or the MID Server can be selected automatically. MID Servers can use domain separation to limit the scope of discoveries and event management.

To discover certain information on a host server, the MID Server must run SSH commands with higher privileges. The platform provides default privileged commands for the MID Server to use and the ability to add additional commands to the system.

The SNMP trap collector is a MID Server extension that listens for SNMP traps from the devices on your network.

Upgrade MID Servers manually, or automatically through the instance. MID Server automatic upgrade is triggered when the instance upgrades and the MID Server no longer has the same version. The new MID Server package is downloaded from install.service-now.com, replaces the old one, and the MID Server starts with the new version.

The vCenter event collector is a MID Server extension that listens for vCenter-related events and updates the CMDB accordingly.

A MID Server security scheme is the method the MID Server uses to protect sensitive values stored in its config.xml file (for example, the instance password). The scheme defines how those values are encrypted and where the encryption key is stored.

A MID Server configured for IPv6 can connect to ServiceNow and use Discovery over IPv6 for specific addresses.

Use MID Server profiles to configure settings and assign MID Server instances directly from your ServiceNow instance, without accessing host servers or editing configuration files manually.

Before MID Server installation can begin, the network must be prepared to access the instance and download site. There are several installation procedures depending on the host operating system and scale of deployment. Once installed, MID Servers can be configured with many capabilities and features.

MID Servers can be deployed via StatefulSet with any number of replicas. They can scale automatically by leveraging Kubernetes Horizontal Pod Autoscaler (HPA). Horizontal Pod Autoscaler automatically updates a workload resource (such as a Deployment or StatefulSet) to match demand.

After creating a MID server profile, the user can make a new deployment request to prepare the deployment process.​ A deployment request can be different for different container orchestrators.

An agent admin can enter a MID Server Profile and create a deployment request on the instance. She/he can then export the deployment request to a YAML file and use it to deploy MID Servers to Kubernetes or OpenShift cluster.

Containerized MID Server uses a Docker image of the MID Server that allows you to quickly deploy MID Servers at scale. MID Servers are deployed using orchestration tools like OpenShift or Kubernetes. Orchestration tools can automate their deployment and maintenance and add new containers on demand or replace failed containers automatically.

Create a MID Server profile to configure MID Server settings, such as JVM memory, from your ServiceNow instance. MID Server profiles are available starting with the Zurich release and apply to all MID Server types.

The External Communication Channel (ECC) Queue is a connection point between an instance and the MID Server. Jobs that the MID Server needs to perform are saved in this queue until the MID Server is ready to handle them.

In environments using Windows Remote Management (WinRM), Discovery or Service Mapping can discover servers using the WinRM protocol. Add servers, which are part of WinRM, as trusted hosts on all MID Servers that Discovery or Service Mapping use for discovery.

MID Server acts as the mediator between the network and the instance. MID Servers are used by other applications to connect to the instance.

Configure the MID Server to use a client certificate for authenticating to the instance. This avoids the need to create a basic authentication credentials in the Key Store for the MID Server's configuration.

If you decide to use credential-less Discovery in your network, you must install Nmap on each Windows MID Server that you want to use for this purpose. Self-hosted customers whose network security does not permit downloads from install.service-now.com must use a specific manual process to install and configure Nmap.

A monitor thread runs in the MID Server to clean up old files, to keep the size and quantity of files within the install folder manageable, and to prevent performance issues with the MID Servers.

This feature allows resources to be reserved before a task is assigned to a thread. If the resources the task needs aren’t available, then that task waits in the MID Server work queue while other tasks are assigned to the thread.

The command audit log records the commands run by the MID Server for the Discovery application. Review the commands to verify there are no anomalies or errors.

Set basic authentication credentials to update the web service invocation data. For added security, you can enforce basic authentication on each incoming SOAP request to the MID Server.

The MID Server supports three authentication methods to retrieve credentials from Azure Key Vault without storing secrets on the instance.

Deploy Containerized MID Servers on Linux by creating a Docker image with the provided recipes. Containerized MID Server uses a Docker image of the MID Server that allows you to quickly deploy MID Servers at scale.

The MID Server's settings reside in multiple tables and the MID Server prioritizes them in a set order. MIDConfigParameter must be defined with the correct type-style builders.

Windows Data Protection API (DPAPI) encrypts sensitive data from the config.xml file, based on the MID Server user account.

Use the methods in this interface to create a custom external encrypter for the MID Server config.xml file.

The MID Server supports the National Security Cloud (NSC) IL-5 environment, which requires all utilized cryptography to be FIPS validated. The MID server can be run in FIPS Enforced Mode, where only cryptographic algorithms which are FIPS validated are utilized.

Move an existing MID Server that uses basic authentication to ServiceNow certificate-based IPKI authentication. Migrating a MID Server to IPKI preserves the user previously set on that MID Server.

To improve security, Windows MID Servers enforce Windows file permission restrictions. The enforcement limits access to the MID Server files to a restricted allow list of users and groups.

The system provides automatic processes to detect and notify you of possible MID Server credential issues after instance cloning.

Generate a registration key and use it to get a new IPKI certificate for an existing MID Server.

The instance displays warnings when a MID Server breaches its resource thresholds for CPU and JVM memory usage, enabling users to create email notifications or custom scripts when a breach occurs.

Move a MID Server that uses IPKI authentication back to basic authentication by changing its configuration and restarting the service.

Use the methods in this interface to create custom providers that manage secured parameter values in the MID Server config.xml file.

MID Server uses four kinds of security checks to secure external traffic. The security checks use TLS/SSL certificate validation, hostname validation, Certificate Revocation List (CRL), and Online Certificate Status Protocol (OCSP) validation to improve security. Control these security checks with the MID Server certificate check policies table.

The ServiceNow instance has a dedicated table that publishes active issues with MID Servers and alerts administrators when a MID Server is in danger of exceeding its resources.

The MID Server can authenticate to your instance using basic authentication, mTLS, or IPKI methods. The methods differ in what the MID Server presents, who issues and manages the certificate, and how access is revoked.

The instance writes issues involving MID Server user logins and network connectivity to the MID Server Issue [ecc_agent_issue] table and creates events you can use in custom scripts or to send email notifications.

Install MID Servers with the MID Server guided Windows installation package. The package includes an installer that automatically configures OpenJDK to run in the environment. The MID Server can use an existing JRE rather than the provided OpenJDK. Uninstall the MID Server to redeploy it.

Download and install the MID Server on the host machine, test the connection, and then validate the MID Server. Use the manual procedures or the guided setup. Set up multiple MID Servers for load balancing and domain separation. These procedures prepare it for use with any application.

Instance PKI (IPKI) lets a MID Server authenticate to its instance using a JSON Web Token (JWT) signed by an instance-issued certificate. Use IPKI when you want to authenticate MID Servers with certificates that the instance issues.

Learn about configuration parameters, keystore aliases, instance-side tables, and log messages for MID Server IPKI authentication.

The Management, Instrumentation, and Discovery (MID) Server is a Java application that runs as a Windows service or UNIX daemon on a server in your local network. The ServiceNow MID Server enables communication and the movement of data between a ServiceNow instance and external applications, data sources, and services.

The value of any MID Server parameter in the config.xml file can be encrypted. The attributes for all encrypted values are managed from within the configuration file, including the security attribute of the login password.

Parameters control the behavior of a particular MID Server and have lower precedence than MID Server properties.

Prior to an upgrade, the MID Server runs tests to identify issues that could cause the upgrade process to fail or result in a MID Server outage.

Use these tables to locate and manage MID Server profile records, configuration parameters, properties, and assignments stored in the instance database.

A MID Server profile is a named collection of configuration settings that you can apply to one or more MID Server instances from your ServiceNow instance.

MID Server reference information includes system requirements and other information you need to configure a MID Server for your specific needs.

Some MID Server records cannot be altered. Certain special characters are pre-defined in XML and cannot be used in passwords.

You can attach a script file to synchronize to a connected MID Server. Windows Internet Explorer enhanced security blocks downloaded files that it determines are potentially dangerous. However synchronizing the files avoids this security problem.

After configuring your MID Server, you can add security by encrypting MID Server parameter values in the config.xml file. Encryption protects data that the MID Server returns to the ECC Queue. Other available security options include the authorization of SOAP requests, restricting access to the MID Server configuration file, and establishing secure socket layer (SSL) connections.

Use this module to troubleshoot errors that occur during the MID Server upgrade process. The MID Server Upgrade Histories table contains a record of each instance upgrade. The MID Server Upgrade Stages table shows the status of each MID Server and its upgrade progress, including any errors encountered.

You can pin all the MID Servers in your environment to a specific version by setting a system property, or you can configure specific versions for individual MID Servers.

Discovery Quick Start can automatically assign ranges of IP addresses, called subnets, to qualified MID Servers. This subnet auto-assignment requires SNMP credentials for read-only access to routers Discovery uses. The Automation Status Set form shows summary details of subnet Discoveries and the IP range assignments for associated MID Servers.

Set up a new MID Server to authenticate to your instance with instance PKI (IPKI), where the instance issues the certificate that the MID Server uses. Use this procedure for a new MID Server.

The MID Server utilizes SSH clients to perform many discovery actions. During the SSH handshake, both the client and server first determine which algorithms both parties support, then client picks the highest priority algorithm. For the Host Key Algorithm, the client picks highest priority algorithm which both parties support that matches the key type.

When a newly installed MID Server fails to start or shuts down prematurely, improper configuration could be to blame.

Improve MID Server security by setting an automatic timeout to invalidate and shut down inactive MID Servers. You can enable this feature and set the inactivity timeout period globally and for each MID Server.

The MID Server unified key store allows all products on the MID Server to use common certificates and key pairs. This feature allows applications to use the same secure communication channel to the MID Server that the MID Server uses to connect to the instance.

Debugging output from the system log is available in either a summary or detailed view for MID Server user issues, but must be enabled manually.

Use the override feature to write your own filter condition that overrides the normal MID Server selection criteria for an application. An override has precedence over the default filter and can be defined for a specific selection condition.

The instance checks the MID Server for a response every 5 minutes, using a synthetic transaction monitoring system.

Properties control the behavior of all MID Servers or a particular MID Server.

Use these minimum system requirements to allocate resources for computers hosting MID Servers.

Troubleshoot problems with the MID Server to find solutions. Monitor the MID Server to receive alerts about issues as they occur. Troubleshooting procedures exist to resolve specific problems with the MID Server. The Knowledge Base on Hi contains several articles to help you troubleshoot MID Server issues.

MIDSystem variables (referred to by the variable name ms.) provide a variety of methods to get information about the MID Server.

Push the profile settings to the MID Server instances assigned to the profile.

Group multiple MID Servers to form clusters, then configure clusters for fail-over protection or load balancing. Load-balancing clusters automatically balance work between each MID Server to improve stability and performance, as well as handle fail-over. Fail-over clusters have a configured order used to determine which MID Server to use next if a failure occurs.

MID Server capabilities define the specific functions of a MID Server within an IP address range, allowing an application to select the most appropriate MID Server. Configure capabilities on MID Servers for applications like Orchestration, Cloud Management, and Service Mapping.

You can manually configure an IP address range for the MID Server to explore.

Download the MID Server installer package through the instance and make it available for installation on the host. Allow the local network to access the authorized IP addresses to ensure that you can download the installation package and receive automatic upgrades.

Install MID Servers with the MID Server installer and verify it is active. The package includes an installer that automatically configures JRE to run in the environment. The MID Server can use an existing JRE rather than the provided JRE. Uninstall the MID Server to redeploy it.

Start, stop, or restart a MID Server manually when needed.

Install multiple MID Servers on the same host computer. Multiple MID Servers can support each other with load balancing, as well as use domain separation. The number of MID Servers required is determined by factors like network policies, security restraints, and the reliability of the host computer.

Associate the IP address to a DNS name to ensure the appropriate MID Server is selected. The IP Address range configuration determines which MID Server is selected. If the MID Server manages resources within defined IP ranges, all host servers must have their DNS names mapped to an IP address.

The MID Server starts with a default JVM memory allocation, but you can modify this setting in the configuration file.

Pause the MID Server to temporarily prevent it from polling the ECC Queue for work or sending Discovery results back to the instance.

Rekey a MID Server to generate a new private key. Private keys are used to decrypt automation credentials, so that MID Servers can transmit information securely. Key pairs are initially generated when a MID Server is validated, and MID Servers should be rekeyed periodically to meet security requirements.

Change the number of threads used by the MID Server according to performance requirements. MID Servers which compete with other programs for CPU time can use fewer threads than the default. MID Servers which need more speed, and have a host computer powerful enough, can use more threads.

To communicate with the instance, MID Servers need a user ID and the mid_server role. Create the user ID for a MID Server and grant the respective role. To prevent MID Server validation failure, ServiceNow enforces role requirements for MID Server users.

You can configure a default MID Server that an application can use if all other possible MID Servers are unavailable. You can narrow down the list of applications that are included in the definition of ALL.

You can upload a JAR file to an instance and synchronize it to all MID Servers, or write custom probes that use the synchronized JAR file.

You must manually validate the MID Server after it is installed to enable it to execute automation tasks. You can invalidate a MID Server you suspect has been compromised to prevent it from accessing automation credentials in the instance or executing outbound ECC probes.

Confirm that the MID Server host is able to communicate with the instance. Resolve any issues with the network connectivity such as conflicts with firewalls, access control lists, and routing errors. Successful communication is necessary for automatic upgrades.

MID Servers automatically upgrade to match the instance build the next time they communicate with the instance after an instance upgrade. Use this procedure only if you want to upgrade a MID Server immediately or retry the upgrade after an Upgrade failed status.

You can use a CyberArk vault to secure any sensitive data from the MID Server config.xml file.

MID Server guided setup provides a sequence of tasks that help you install a MID Server with the proper user account and validate the MID Server. If you are setting up a MID Server for the first time, this is a good way to get one up and running in your environment quickly.