Daily discovery scans are not working from last one week

You can refer to this KB article to troubleshoot the Discovery Scan issue.

https://beyondtrustcorp.service-now.com/csm?id=kb_article_view&sysparm_article=KB0017069

Is your scan jobs failing or they are not returning any hosts?  

Hi Howard, The scans are not running they are supposed to run every night as scheduled scan. It is not running from last 1 week since we restarted the primary node.

What status do these scans show in BeyondInsight? Are they running and completing, but not showing any assets acquired? Are there scans that appear to have been stuck running for quite some time?

Do the scans appear to not be running at all? If not, it may be worth verifying that the BeyondTrust Discovery Service is running on the UVM.

Is it possible that an HA failover may have inadvertently occurred during the reboot of the Primary UVM?

These are a few things that you can check that hopefully will give a better picture of what might be occurring.

The last scan shows as completed and after that there’s no scan report which shows that the scan even initiated. I hope this helps. 

That’s helpful info! And if you view the Active/Completed scans, does there appear to be a scan stuck running there?

This is the scan I see but it doesnt show as stuck. I should have run next day (16 march) but it never did.

Thanks!

The article that Howard provided contains some helpful commands to check the status of the Discovery scanner; I’ll include some relevant ones here:

Steps

1. RDP to the scanner server

2. Open Command Prompt as admin

3. Run the following command:

cd 'C:\Program Files\BeyondTrust\Discovery\'

Lets check the status of the BeyondTrust Discovery Service to confirm its running; this should return “Running”:

btdiscovery getd

Next let’s test Central Policy; this should return “Ok”:

btdiscovery testc

Let’s test the Event Client; this should return “Ok”:

btdiscovery teste

Finally, let’s confirm that the scheduled scan job is present on the Discovery scanner; this will return a list of the scheduled scans present - we would typically expect yours to be listed here:

btdiscovery gets

Thank you, I will try and confirm. Sorry scanner server means the UVM or the RDS?

Good catch - apologies for the confusion; RDP into the UVM to run these commands.

Hi Ryan, i have run all the commands and got the desired results as well. What’s next I can follow please share?

If all are the previous commands are returning the Running/Ok, and show the expected scheduled scan job is present, try running the following and check if any scans of the previous scan jobs appear to be stuck running; you can run this from the same path as the other commands; this will output a potentially long list of previously completed scans - scroll through to see if any of them appear to be stuck running or showing some other unexpected state:

btdiscovery getj

Thanks, I tried that as well and saw the the desired scan did ran every day but after 16th march is only shows (0 of 0 completed) and earlier it used to be (~430 of ~430 completed). It seems there are no assets found during the scans. Kindly suggest. 

There does appear to be a scan stuck running from March 17th: “(432 of 433 completed) - Running”. It appears it may be hung up waiting for one specific target to complete.

I would suggest to open a case with the BeyondInsight support team and include all the details that we’ve found so far. They will also want Discovery scan logs for review; you can pack up the discovery scan logs by running the following command:

btdiscovery pack

This will place a zip file in the following path, which you can upload to the case for review:  C:\Program Files\BeyondTrust\Discovery\Support\

Thank you, I will do that. :) Appreciate your help. 

For Linux scan issues, enable SSH debug and SSH text before getting a discovery pack: How to enable SSH text and SSH debug logs for the BeyondTrust Discovery Agent

Check for the error in the  ####_Phoenix.Service.<datestamp>.log file in C:\Program Files BeyondTrust\Discovery and review the following article: Discovery Scanner cannot connect to target system

I would like to thank everyone and who has replied to my query. Let me share that this is now sorted and mostly the stuck scans are now processed after restarting the discovery service from the scanner system.