Application Dependency Mapping \(ADM\) for Discovery

reference brazil Updated Sep 10, 2026 8 min read r_ApplicationDependencyMapping.md
Raw file servicenow.com

Application Dependency Mapping (ADM) discovers CIs by detecting TCP connections between devices.

When ADM discovery is enabled, Discovery always runs the ADM probes during the exploration stage to find the TCP traffic on your network. Using these TCP connections, Discovery can find additional CIs and create relationships between them.

IPv6 Is supported for ADM.

Note: Currently, ADM does not support multi-languages. If values returned are not in English, the returned data cannot be parsed properly and the discovery will fail.

Standard and enhanced ADM discovery

  • Standard ADM discovery

    Triggers an ADM probe to take a single snapshot of TCP connections on target machines using netstat and lsof commands. However, it does not detect new TCP connections that occur between these 24-hour intervals.

    Standard ADM discovery is enabled by default.

  • Enhanced ADM (ADME) discovery

    Triggers an enhanced ADM probe that installs a script on host machines on which Discovery takes regular samples of active TCP connections. You can use a set of properties and probe parameters that control several aspects of enhanced ADM discovery.

    ADME discovery is not enabled by default.

Service Mapping uses the ADM probes for traffic-based discovery. See Discovery based on Predictive Intelligence for more information.

TCP tracking file for enhanced ADM

The first time that Discovery launches the enhanced probe, no TCP information is gathered. Rather, the enhanced probe only deploys the TCP tracking file, in which information about detected TCP connections is saved. After Discovery runs again, the enhanced probe relays the contents of the TCP tracking file back to the instance via the MID Server. The information is saved in the CMDB.

The TCP tracking file is saved in these locations by default:

  • Windows: admin$\temp\{your_instance_name}. While TCP connections are being monitored, the information is stored in memory and then later saved to the file.
  • Linux: /tmp/{your_instance_name}.

You can change the location and other aspects of the tracking file with ADM properties.

If you disable enhanced ADM, Discovery cleans up the folders from the host file system the next time Discovery runs, but the TCP tracking file remains.

Supported operating systems

Both standard and enhanced ADM discovery support the following operating systems:

  • Windows Server 2012 R2 and later
  • CentOS and Ubuntu
  • Solaris (On Solaris machines, enhanced ADM is available in global zones. Only standard ADM is available for local zones.)
  • AIX
  • HP-UX

Requirements for enhanced ADM

Before you enable enhanced ADM, make sure that each target host meets the requirements for its operating system.

Operating system Network tools Sudoer entries required Additional requirements
AIX netstat with rmsock. lsof is used if netstat doesn't work. Yes: ADME_CMDS rmsock must be in the system PATH. AIX netstat doesn't output process IDs, so rmsock resolves the socket addresses in netstat -Aan output to process IDs. rmsock is part of the base AIX installation.
CentOS and Ubuntu netstat. lsof is used if netstat isn't available, and ss is used if neither is available. Yes: ADME_CMDS At least one of lsof, netstat, or ss must be in the system PATH. If none of these tools is found, ADME logs an error and fails.
HP-UX lsof only. netstat isn't supported. Yes: ADME_CMDS lsof must be installed and in the system PATH, and its path must match the sudoer entry. Without lsof, ADME can't collect network connection data.
Solaris 11.2 and later netstat Yes: ADME_CMDS, ADME_PS, pfiles, and pgrep Add the lsof installation path to secure_path in the sudoers file.
Solaris versions earlier than 11.2 lsof Yes: ADME_CMDS, ADME_PS, pfiles, and pgrep lsof must be installed, its path must match the sudoer entry, and the path must be in secure_path in the sudoers file.
Windows netstat, which is built in No. Administrative credentials are passed through the Discovery credential record. PowerShell 3.0 or later on the target host.
Permission Applies to Notes
Local administrator on the target host Windows Required to enumerate all processes and connections.
Network access to the target host Windows WMI uses TCP port 135 and dynamic ports. WinRM uses TCP port 5985 or 5986.
PowerShell ExecutionPolicy Bypass Windows Set inline for each invocation. No persistent policy change is made.
Write access to admin$\temp Windows Default staging location for scripts and results.
Passwordless sudo access for the discovery user to the commands in the sudoer entries AIX, CentOS and Ubuntu, HP-UX, Solaris Required to run the network and process commands as root. On Solaris, both the ADME_CMDS and ADME_PS entries are required.
Root access for the discovery user to pfiles and pgrep Solaris Applies to both standard ADM and enhanced ADM.
SSH access to the target host AIX, CentOS and Ubuntu, HP-UX, Solaris The MID Server connects to the target host through SSH.
Write access to /tmp AIX, CentOS and Ubuntu, HP-UX, Solaris Default staging directory. You can change it with the glide.discovery.adme.base_dir_unix property. For more information, see Configure ADM discovery parameters and properties.

Note: If you set your Windows server Execution Policy to RemoteSigned or AllSigned, ADME can run PowerShell scripts. You must import the ServiceNow certificate to the trusted publisher in order for the scripts to execute properly.

Configure the sudoers file for enhanced ADM

On UNIX and Linux hosts, the Discovery user must have passwordless sudo access to the commands in the sudoer entries for its operating system. The MID Server uses this user to run the commands as root and collect TCP connection data. Windows hosts don't use the sudoers file. Administrative credentials are passed directly through the Discovery credential record.

Each sudoer entry follows the same pattern:

  • The Cmnd_Alias ADME_CMDS line defines ADME_CMDS as the list of commands that enhanced ADM runs. On Solaris, the Cmnd_Alias ADME_PS line defines a second list for the process command.
  • The discoUser ALL=(root) NOPASSWD:ADME_CMDS line lets the Discovery user run the listed commands as root without a password. discoUser is the user in your Discovery credential.
  • The Defaults line disables requiretty so that the commands can run over an SSH session without a terminal.

The command paths in the entries are the default installation directories for each tool. If a tool is installed in a different directory on your hosts, adjust the path in the sudoer entry.

  • AIX

    Add these entries to the sudoers file on each AIX host:

    Text
    Cmnd_Alias ADME_CMDS = /usr/bin/netstat -Aan, \                       /usr/sbin/lsof -iTCP -n -PdiscoUser ALL=(root) NOPASSWD:ADME_CMDSDefaults:discoUser ! requiretty

  • CentOS and Ubuntu

    Add these entries to the sudoers file on each CentOS or Ubuntu host:

    Text
    Cmnd_Alias ADME_CMDS = /usr/sbin/lsof -iTCP -n -P, \                       /usr/bin/netstat -antp, \                       /sbin/ss -tlnp, \                       /sbin/ss -tenpdiscoUser ALL=(root) NOPASSWD:ADME_CMDSDefaults!ADME_CMDS !requiretty

  • HP-UX

    Add these entries to the sudoers file on each HP-UX host:

    Text
    Cmnd_Alias ADME_CMDS = /usr/local/bin/lsof -iTCP -n -PdiscoUser ALL=(root) NOPASSWD:ADME_CMDSDefaults!ADME_CMDS !requiretty

  • Solaris

    Add these entries to the sudoers file on each Solaris host:

    Text
    # ADME network commands:Cmnd_Alias ADME_CMDS = /usr/bin/netstat, \                       /opt/csw/bin/lsof -iTCP -n -P -zglobaldiscoUser ALL=(root) NOPASSWD:ADME_CMDSDefaults!ADME_CMDS !requiretty
# Standard ADM + ADME process commands:Cmnd_Alias ADME_PS = /usr/ucb/psdiscoUser ALL=(root) NOPASSWD:ADME_PSDefaults!ADME_PS !requiretty
Disco ALL=(root) /usr/bin/pfilesDisco ALL=(root) /usr/bin/pgrep

    Add the lsof installation path to secure_path in the sudoers file. For example, if lsof is in /opt/csw/bin, use secure_path = /usr/bin:/usr/sbin:/bin:/sbin:/opt/csw/bin.

    Note:

    • In global zones, you must add -zglobal to the lsof entry.
    • The ADME_PS, pfiles, and pgrep entries apply to standard ADM as well as enhanced ADM.
    • Enhanced ADM detects the lsof path by using command -v lsof or which lsof. Make sure that the path in the sudoer entry matches the detected path.

Note: If the sudoer configuration is incorrect or requiretty is not disabled, ADME logs the following error in the stderr.log file: Possible error in sudoer configuration or requiretty is not configured.

Set up and use enhanced ADM

To set up and use enhanced ADM, perform these steps:

  1. Enable enhanced ADM with the glide.discovery.enable_adme Discovery property.
  2. Determine the base directory where the TCP tracking file is placed on the host computers. If you want to change the location, specify it in these Discovery properties:
    • glide.discovery.adme.base_dir_unix
    • mid.powershell.target_base_dir
  3. Do either of the following based on the operating systems of the host computers:
    • UNIX and Linux: modify the sudoers file to include the necessary commands.
    • Windows: Set the mid.windows.management_protocol parameter on the MID Server to use WinRM or WMI. This parameter sets the protocol that your MID Server uses to communicate with remote Windows hosts.
  4. Create a schedule and run Discovery.
  5. View the results in the TCP tables.
  6. Optionally control both the size of the TCP tracking file and the payload using parameters on the enhanced ADM probes. See TCP connection discovery for the names of the probes and parameters.

Parent Topic:Advanced Discovery configuration

Search documentation
Search document titles and file paths on the brazil branch