Instance Scan "Sanity Test" Scan Check examples

Articles, Blogs, Videos, Podcasts, Share projects - Experiences from the field

Hi there,

When talking about Instance Scan, mostly mentioned for setting up Scan Checks is about performing checks on code, certain settings on Business Rules / Client Scripts / Script Includes, etcetera. Though why limit ourselves to only best practices on the coding front? Instance Scan has a really powerful scan engine, with which you can interrogate your instance way more.

Sanity Test

In this article I'll share some examples of Scan Checks which you could use for a "Sanity Test" suite. Sanity Test checks which you could perform regularly. For example daily, to support the daily activities of a System Administrator. Or Scan Checks which you could perform before/after a Hot Fix / Patch / Release Upgrade or a System Clone.

Sanity Test examples

Table Check: Could not verify Remote instance connection

Category
Manageability

Description
Connection test for the remote instance defined did not result in a positive response.

Documentation
https://docs.servicenow.com/csh?topicname=t_DefineARemoteInstance.html&version=latest

Table
sys_update_set_source

Condition
active=true

Script

(function (engine) {

	// Define variables
	var instance_url = engine.current.url.replace(/\/$/, ""),
		user_name = engine.current.username,
		user_password = new GlideEncrypter().decrypt(engine.current.password);
	
	// Execute REST request
	var request = new sn_ws.RESTMessageV2();
	request.setEndpoint(instance_url + '/api/now/table/sys_user?sysparm_query=user_name%3D' + user_name + '&sysparm_limit=1');
	request.setHttpMethod('GET');

	request.setBasicAuth(user_name, user_password);
	request.setRequestHeader('Accept', 'application/json');

	var response = request.execute(),
		status = response.getStatusCode();

	// Create scan finding
	if(status != 200) {
		engine.finding.increment();
	}

})(engine);

Script Only Check: High number of workflows running for a single record

Category
Manageability

Description
In general, for a single record only a few Workflow contexts will be running. If a high number of Workflow contexts are active, this often indicates an issue on the starting conditions of your Workflow. More than 10 active Workflow contexts is considered to be a high number.

Script

(function (finding) {

	// Count record
	var countRecord = new GlideAggregate('wf_context');
	countRecord.addEncodedQuery('state=executing');
	countRecord.groupBy('id');
	countRecord.addAggregate('COUNT');
	countRecord._query();

	while(countRecord._next()) {
		if(countRecord.getAggregate('COUNT') > 10) {
			// Get record
			var getRecord = new GlideRecord('wf_context');
			getRecord.addQuery('id', countRecord.id);
			getRecord.setLimit(1);
			getRecord._query();

			if(getRecord._next()) {
				// Create scan finding
				var createFinding = new GlideRecord(getRecord.getValue('table'));

				if(createFinding.get(getRecord.getValue('id'))) {
					finding.setCurrentSource(createFinding);
					finding.increment();
				}
			}
		}
	}

})(finding);

Table Check: Parent All Nodes/Active Nodes without childs

Category
Manageability

Description
Schedule records with system ID "all Nodes" or "active nodes", are considered to be parent schedules. Parent schedules that themselves will never run but instead spawn child jobs (of the same name) for each application node required by their definition. Jobs with system ID "all nodes", are typically background maintenance jobs required for general node health and management. Jobs with system ID "active nodes", are typically jobs that need to run the same event processor or other jobs that need increased processing bandwidth across the platform.

Table
sys_trigger

Condition
system_idINALL NODES,ACTIVE NODES

Script

(function (engine) {

	// Define variables
	var table_name = 'sys_trigger',
		encoded_query = 'name=' + engine.current.name;
	
	// Query record
	var getRecord = new GlideRecord(table_name);
	getRecord.addEncodedQuery(encoded_query);
	getRecord.setLimit(1);
	getRecord._query();

	// Create scan finding
	if(!getRecord.hasNext()) {
		engine.finding.increment();
	}

})(engine);

Table Check: Unprocessed queues

Category
Manageability

Description
External Communication Channel (ECC) Queue is a connection point between an instance and the MID Server. Jobs that the MID Server needs to perform are saved in this queue until the MID Server is ready to handle them. The default polling interval is set to 40 seconds. When there are unprocessed queue records, this can indicate a large volume of queue records, a processing issue in general, or a MID Server issue.

Table
ecc_queue

Condition
state=ready^sys_created_onRELATIVELT@minute@ago@5

Table Check: Unprocessed schedules

Category
Manageability

Description
Schedules with a state "Ready" run at the next scheduled interval (this does not include schedules with trigger type "Run at System Startup" and "On Demand"). When there are unprocessed schedules, this can indicate a large volume of schedules, a processing issue in general, or errors on the individual schedule itself.

Documentation
https://docs.servicenow.com/csh?topicname=c_ScheduledJobs.html&version=latest

Table
sys_trigger

Condition
state=0^next_actionRELATIVELT@minute@ago@5^trigger_typeNOT IN2,9^system_idNOT INALL NODES,ACTIVE NODES

Script

(function (engine) {

	// Define variables
	var table_name = 'sys_cluster_state',
		encoded_query = 'system_id=' + current.system_id + '^status=online';
	
	// Query record
	var getRecord = new GlideRecord(table_name);
	getRecord.addQuery(encoded_query);
	getRecord.setLimit(1);
	getRecord._query();

	// Create scan finding
	if(getRecord.hasNext()) {
		engine.finding.increment();
	}

})(engine);

GitHub example-instancescan-checks

The example Linter Checks mentioned in this article can also be found on the "example-instancescan-checks" GitHub repository. Also other Scan Checks can be found there which have been contributed by several people. 

---

And that's it actually. Hope you like it. If any questions or remarks, let me know!

Kind regards,

Mark Roethof

ServiceNow Technical Platform Architect @ Quint Technology

2x ServiceNow Developer MVP

2x ServiceNow Community MVP

---

LinkedIn